Is Ziplyne Flex Staging Creator safe?

Ziplyne Flex Staging Creator overwrites its stored authentication token with data from unauthenticated postMessage events on any page.

This extension injects a content script into every website and listens for 'authentication' postMessage events, but never checks which page sent them. Any web page a user visits can send a message that overwrites the extension's stored creator/player token and user role in chrome.storage.local. That token is then attached as a Bearer credential on the extension's own API calls to flexstagingapi.ziplyne.com.

Part of this rating comes from analysis signals we haven't published as detailed findings yet.