Is Violentmonkey safe?

Violentmonkey bundles a hardcoded Google OAuth client_secret that is transmitted to Google's token endpoint during Drive sync.

Violentmonkey is a userscript manager that runs user-supplied scripts on web pages. Its Google Drive sync feature uses a confidential-client OAuth flow unsuitable for browser extensions, embedding the client_secret directly in the extension bundle. The secret is sent in POST requests to www.googleapis.com/oauth2/v4/token during authorization and token refresh.

Part of this rating comes from analysis signals we haven't published as detailed findings yet.