Is Text Editor safe?
We analyzed Text Editor version 0.2.5's actual code and gave it a 84/100 trust score. This is a mostly purpose-aligned text editor with moderate…
Bottom line
This is a mostly purpose-aligned text editor with moderate local-file access and minor lifecycle tracking.
What it can access
Storage and optional downloads fit a text editor, while selected files or folders can be read and written after your action.[Q1][Q5][Q18][Q19]
Security weaknesses
File access is user-mediated, remote commands are not exposed, and the questionable packaged code path is blocked from dynamic execution.[Q5][Q11][Q16][Q21]
Signs of misuse
The extension reports install, update, and removal events by opening the developer site, but no sensitive content collection or tracking was found.[Q6][Q8][Q12][Q14]
Code findings
What access does this extension ask for, and does that access make sense for what it claims to do?
It requests storage and unlimitedStorage for preferences and optional session snapshots. Downloads permission is optional and requested only when the modern file-picker services is unavailable.
Declares storage, unlimitedStorage and optional downloads, with no host permissions. — manifest.json:7-20
Explains and requests Downloads access only for the legacy file-writing path. — data/interface/resource/fileio.js:120-168,469-480
Which websites can it run on, and can it read or change what appears on those pages?
No evidence of this behavior was found in the reviewed package.
Contains no host_permissions, content_scripts or activeTab permission. — manifest.json:4-20
The toolbar button opens or focuses the packaged editor interface. — lib/common.js:20-38
Can it see sensitive information you type, such as passwords, payment details, messages, or form entries?
No evidence of this behavior was found in the reviewed package.
Provides no site access. — manifest.json:4-20
Reads files selected through a browser picker or local file input. — data/interface/resource/fileio.js:171-228,579-610
Can it access private browser data such as cookies, signed-in sessions, browsing history, bookmarks, or downloads?
No evidence of this behavior was found in the reviewed package.
Declares none of the browsing-data permissions. — manifest.json:7-20
Opens the fixed homepage on install and occasional update. — lib/runtime.js:1-22
Can it access anything else on your device, such as files, location, camera, microphone, clipboard, or installed applications?
It can read and write files or recursively read folders that the user explicitly selects. Session restore can retain file handles and complete file contents locally; the setting is off by default.
Uses user-facing file/folder pickers and returned handles for local reads and writes. — data/interface/resource/fileio.js:57-85,87-117,171-228,559-610
When session restore is enabled, stores handles in IndexedDB and file contents in chrome.storage.local. — data/interface/resource/config.js:474-536,538-645
Session restore defaults to false. — data/interface/resource/config.js:122-138
Does it send information outside your browser? If so, what information is sent, where does it go, and why?
No editor or file content is uploaded. Install, update and uninstall flows open the fixed mybrowseraddon.com homepage with extension version and event type in the URL, disclosing those lifecycle details to the developer site.
Sets an uninstall URL and opens the homepage with v, type and sometimes previous-version parameters. — lib/runtime.js:1-22
Fixes the homepage to mybrowseraddon.com/text-editor.html. — manifest.json:9
Manual first-party network searches found no file-content submission path. — inventory.json:1
Does it download or run code, settings, or instructions supplied by a remote server?
No evidence of this behavior was found in the reviewed package.
Lists and loads fixed packaged CodeMirror assets. — data/interface/resource/config.js:162-415,430-470
Editor behavior is driven by locally stored preferences. — data/interface/resource/v5/options.js:1-220
Can it take actions without a clear user request, such as opening pages, redirecting searches, downloading files, or sending requests?
The service worker automatically registers lifecycle handlers. It may open the developer homepage on install, updates spaced more than 45 days apart, and uninstall; file reading and editing still require user interaction.
Registers install/update/uninstall homepage behavior and limits update pages with a 45-day check. — lib/runtime.js:1-22
Normal editor launch follows a toolbar action. — lib/common.js:20-42
Can it change important browser settings, including your proxy, search engine, homepage, privacy settings, or other extensions?
No evidence of this behavior was found in the reviewed package.
Requests no settings, proxy, search or management permission; getSelf is used only to check install type. — manifest.json:7-20
Management getSelf gates the welcome tab to normal installations. — lib/runtime.js:6-20
Is any important behavior difficult to inspect because the code is hidden, heavily obfuscated, dynamically generated, or supplied by third parties?
The package contains large minified CodeMirror and linting libraries, which increase review complexity. First-party file, storage and lifecycle logic is readable, and the bundled assets are loaded from explicit local paths.
Shows readable first-party modules alongside large packaged editor/linter libraries. — inventory.json:1
Enumerates the packaged CodeMirror, mode and lint assets by local path. — data/interface/resource/config.js:162-415
Does it use eval(), new Function(), or string-based timers to turn text into executable code?
A packaged Pug syntax mode passes a local attribute fragment to Function() to test whether it parses, but never invokes the returned function. Chrome extension CSP blocks dynamic compilation, and no remote text reaches this path.
Constructs Function('', 'var x ' + local syntax text) inside try/catch, without calling the result. — data/interface/vendor/codemirror/v5/mode/pug/pug.js:399-414
Does not relax the Manifest V3 extension-page CSP to allow unsafe-eval. — manifest.json:1-37
Loads the Pug mode from a fixed packaged file as one of many syntax highlighters. — data/interface/resource/config.js:293-415
Does it track the websites, pages, searches, or links you visit?
No evidence of this behavior was found in the reviewed package.
Declares no history, tabs or host access. — manifest.json:7-20
Builds only the fixed homepage lifecycle URLs. — lib/runtime.js:1-22
Does it create a persistent ID or browser fingerprint to recognize you?
No evidence of this behavior was found in the reviewed package.
Background storage covers welcome timing and editor-window size. — lib/config.js:1-17
Manual endpoint and identifier searches found no analytics or fingerprinting flow. — inventory.json:1
Does it send cookies, session details, authentication data, or page contents elsewhere?
No evidence of this behavior was found in the reviewed package.
Declares no cookies or host access. — manifest.json:7-20
Selected file contents go into local editor objects. — data/interface/resource/fileio.js:171-228
Does it record typing, form entries, clipboard contents, or screenshots?
No evidence of this behavior was found in the reviewed package.
Registers keyboard/mouse listeners inside the extension editor document. — data/interface/index.js:63-72
Provides no ability to inject those listeners into websites. — manifest.json:4-20
Can a website or remote server send commands that make the extension take actions?
No evidence of this behavior was found in the reviewed package.
Dynamic script elements receive only paths from a fixed packaged manifest. — data/interface/resource/config.js:162-415,430-470
First-party source contains no fetch/XHR/WebSocket configuration client. — inventory.json:1
Does it alter links, referral codes, advertisements, shopping carts, or search results?
No evidence of this behavior was found in the reviewed package.
Builds file and folder rows with createElement, textContent and attributes. — data/interface/resource/sidebar.js:69-141,343-450
Contains no content script or host access. — manifest.json:4-20
Does it redirect or modify web traffic, request headers, downloads, or proxy settings?
It can create or overwrite user-selected local files. On browsers without the File System Access services, an optional Downloads permission saves a Blob to the downloads folder and erases the browser's download-list entry afterward.
Writes editor text through a Blob download or a user-granted writable file handle. — data/interface/resource/fileio.js:317-466
Tracks completion, removes the download-history entry and revokes the temporary Blob URL. — data/interface/resource/listeners.js:120-161
Can it communicate with software on the computer or services running on localhost?
It uses browser file and directory pickers for local disk access, limited to user-selected targets and browser permission prompts. No native application, shell or unrestricted filesystem bridge was found.
Calls showSaveFilePicker, showDirectoryPicker and showOpenFilePicker from user actions. — data/interface/resource/fileio.js:87-117,559-610
Does not request nativeMessaging. — manifest.json:7-20
Does it decode, decrypt, or unpack hidden data and then execute or inject it?
No evidence of this behavior was found in the reviewed package.
Script loaders use only the static packaged engine manifest. — data/interface/resource/config.js:162-415,430-470
Creates CodeMirror with file content as the editor value and a selected syntax mode. — data/interface/resource/v5/editor.js:288-341
Can ordinary websites access privileged extension features through messaging or exposed files?
No evidence of this behavior was found in the reviewed package.
Uses chrome.runtime messaging for the packaged interface. — data/interface/index.js:1-60
Contains no externally_connectable or content-script declaration. — manifest.json:4-37
Does suspicious behavior activate only for certain users, websites, dates, or remote settings?
No evidence of this behavior was found in the reviewed package.
Defines local defaults, including session=false. — data/interface/resource/config.js:122-138
Provides the visible Restore Session checkbox and saves the user's choice. — data/interface/resource/sidebar.js:202-237
Does it perform hidden resource-intensive work, such as cryptocurrency mining?
No evidence of this behavior was found in the reviewed package.
The service worker only manages the editor window and lifecycle state. — lib/common.js:1-42
Manual source searches found no mining endpoint or hashing workload. — inventory.json:1
Does it change form fields or where a form sends its information?
No evidence of this behavior was found in the reviewed package.
No host access or content script can reach website forms. — manifest.json:4-20
Defines the isolated packaged editor shell. — data/interface/index.html:1-65