Is Tarss safe?
Tarss reads every linkedin.com cookie, including the HttpOnly li_at session token, and sends it as the Authorization header to api.tarss.fr.
The background worker calls chrome.cookies.getAll for the linkedin.com and www.linkedin.com domains, concatenates each cookie as name::value, and hands the full string into the bundled Blazor app, which uses it to authorize requests to the extension's backend at api.tarss.fr. This captures the HttpOnly li_at session token that page JavaScript cannot otherwise read. When no LinkedIn tab is open, the worker silently opens a hidden pinned background tab to www.linkedin.com on a 1s/30s polling interval to refresh those cookies.
Part of this rating comes from analysis signals we haven't published as detailed findings yet.
AI-generated. Findings may contain errors. Those marked Verified have been manually reviewed.
Publishers can request a review.
Where it sends data
Destinations our analysis observed Tarss contacting. Sending data somewhere is not a finding on its own - an extension that syncs your settings has to talk to its own server - but it is where your data can go, and who else it goes to.
- api.tarss.fr
Tarss sends data to api.tarss.fr. No other extension we have analyzed sends data here.