Is Workbench safe?
Workbench exposes stored Salesforce connection secrets and an OpenAI key to sf-toolkit.com pages.
When a user opens a matching sf-toolkit.com page, Workbench reads saved connection records and the stored OpenAI key from Chrome local storage. It inserts that data into hidden page elements, which can include Salesforce passwords, access tokens, refresh tokens, session IDs, and auth URLs when those connection types are configured.
AI-generated. Findings may contain errors. Those marked Verified have been manually reviewed.
Publishers can request a review.
Where it sends data
Destinations our analysis observed Workbench contacting. Sending data somewhere is not a finding on its own - an extension that syncs your settings has to talk to its own server - but it is where your data can go, and who else it goes to.
- sf-toolkit.com
Workbench sends data to sf-toolkit.com. No other extension we have analysed sends data here.