Is Toggl Plan: Project Planning Calendar safe?

Question

Accepted Answer

Toggl Plan: Project Planning Calendar is medium risk. The extension includes Toggl OAuth client credentials in its shipped bundle. When authentication tokens are requested, those credentials are used with the Toggl token endpoint, making the client secret recoverable from the distributed extension without authentication. When you click an injected Toggl Plan button on supported project-management sites, the extension sends a Google Analytics event that includes the current page URL and hostname. The event is also associated with the Toggl user ID stored by the extension, linking those page details to the account identifier.

Is Toggl Plan: Project Planning Calendar safe?

Findings