in window.location.hash.\nfunction checkForToken() {\n const urlParams = new URLSearchParams(window.location.hash.slice(1));\n const token = urlParams.get('token'); // the raw Trello API token\n if (token) {\n chrome.runtime.sendMessage({action: \"saveToken\", token: token});\n }\n}","sourceFile":"content.js (annotated)"}],"technicalNote":"manifest.json content_scripts.matches is scoped to https://trello.terekhovsergei.life/redirect.html with run_at: document_end, so this capture code only runs after that externally-hosted document has fully loaded."},{"kind":"third_party_list","caption":"Where the token and later API calls go","hosts":[{"host":"trello.terekhovsergei.life","purpose":"Registered to the extension developer, not Trello. Receives your full-access token in the URL before the extension's own code reads it."},{"host":"api.trello.com","purpose":"Trello's own API. The extension sends your token here afterward to list boards and create cards, which is the extension's stated purpose."}]},{"kind":"artifact","purpose":"reproducer","filename":"redirect-page-stub.html","language":"html","description":"A stand-in for the return page that shows a token in the URL fragment is readable by page script the instant the document parses, before a document_end content script can run.","code":"\n\n\n \n\n\n

Stand-in for trello.terekhovsergei.life/redirect.html

\n\n","usage":"1. Save as redirect-page-stub.html. 2. Serve it: python3 -m http.server 8000. 3. Open http://localhost:8000/redirect-page-stub.html#token=TEST123. 4. Check the console: the inline script already logged the token.","requires":["Any static file server, e.g. Python 3's http.server module"]},{"kind":"plain_note","body":"Static analysis finding. This behaviour was identified by reading the shipped extension code and has not yet been reproduced in a live run. The trigger conditions and the exact data sent are read from the code, not from an observed capture."}],"scaleMetrics":[{"label":"Token lifetime","value_label":"Never expires","fill":1,"tier":"error"},{"label":"Access granted","value_label":"Full read + write","fill":1,"tier":"error"},{"label":"Delivery point","value_label":"Third-party page","fill":0.8,"tier":"warning"},{"label":"OAuth flow used","value_label":"Legacy implicit-token","fill":0.7,"tier":"warning"}],"trustTier":"ai-found","userActions":[]},"variant":"inline","expectedKind":"unexpected","showVerificationBadge":false}]]}]],false]}]]}] 23:["$","footer",null,{"className":"border-border space-y-6 border-t pt-6","children":["$","div",null,{"className":"text-muted-foreground flex flex-wrap gap-x-5 gap-y-1 text-xs","children":[["$","span",null,{"children":["Updated ","9 September 2026"]}],["$","span",null,{"className":"font-mono","children":"phpjpmcmejhepkddncmnfaphebgaecec"}]]}]}]

Is Trello Task Creator safe?

Findings