Is Tarss safe?

Tarss reads every linkedin.com cookie, including the HttpOnly li_at session token, and sends it as the Authorization header to api.tarss.fr.

The background worker calls chrome.cookies.getAll for the linkedin.com and www.linkedin.com domains, concatenates each cookie as name::value, and hands the full string into the bundled Blazor app, which uses it to authorize requests to the extension's backend at api.tarss.fr. This captures the HttpOnly li_at session token that page JavaScript cannot otherwise read. When no LinkedIn tab is open, the worker silently opens a hidden pinned background tab to www.linkedin.com on a 1s/30s polling interval to refresh those cookies.

Part of this rating comes from analysis signals we haven't published as detailed findings yet.