Is TurboType safe?
TurboType lets any web page trigger its message bridge to clear snippet state or start an authenticated snippet sync.
TurboType injects a content script on all pages and accepts window messages targeting turbo-type without checking the sending page's origin. A page can send actions that clear stored snippet/auth state or ask the background script to refresh snippets from the TurboType API using the stored authorization token.
Part of this rating comes from analysis signals we haven't published as detailed findings yet.
AI-generated. Findings may contain errors. Those marked Verified have been manually reviewed.
Publishers can request a review.
What it can do
Permissions this extension asks for, as declared in version 0.1.10. Asking for a permission is not a finding on its own - it is what the extension can do if it chooses to.
Add items to the right-click menu
contextMenus
Act on the current tab, but only after you click the extension
activeTab
Store data in your browser
storage
Store an unlimited amount of data in your browser
unlimitedStorage
Read whatever you have copied to your clipboard
clipboardRead
Write to your clipboard
clipboardWrite
Run hidden pages in the background
offscreen
Where it sends data
Destinations our analysis observed TurboType contacting. Sending data somewhere is not a finding on its own - an extension that syncs your settings has to talk to its own server - but it is where your data can go, and who else it goes to.
- www.turbotype.app
TurboType sends data to www.turbotype.app. No other extension we have analysed sends data here.