Is WEB.DE MailCheck for Firefox safe?

WEB.DE MailCheck for Firefox enables analytics on update and ships hardcoded OAuth client secrets for four mail providers.

When upgrading from versions before 8.0.0, the extension automatically sets analytics opt-in flags and begins sending daily, weekly, and monthly usage events — including a persistent device ID, account counts, browser language, and user segment — to tgw.web.de. Additionally, the extension bundle contains hardcoded Basic-auth credentials for OAuth token endpoints at GMX, GMX.com, mail.com, and WEB.DE, which are sent as Authorization headers during token refresh.

Part of this rating comes from analysis signals we haven't published as detailed findings yet.