Is Simply Todo safe?
We analyzed Simply Todo version 1.1's actual code and gave it a 95/100 trust score. Simply Todo has narrow, purpose-appropriate access and no package…
Bottom line
Simply Todo has narrow, purpose-appropriate access and no package evidence of misuse or meaningful security weaknesses.
What it can access
It only stores todo items and preferences, with no website or device access requested, which fits its stated purpose. [Q1]
Security weaknesses
No meaningful weakness was found: the package shows no dynamic code execution, remote commands, or ordinary-website access to privileged features. [Q11][Q16][Q21]
Signs of misuse
There is no evidence of data being sent outside the browser, remote code control, or actions unrelated to managing todos. [Q6][Q7][Q8][Q14]
Code findings
What access does this extension ask for, and does that access make sense for what it claims to do?
It requests only Chrome storage, which is appropriate for synchronizing todo items and preferences.
Declares only the storage permission and a popup/background worker; there are no host permissions or content scripts. — manifest.json:2-35
Which websites can it run on, and can it read or change what appears on those pages?
No evidence of this behavior was found in the reviewed package.
Contains no content_scripts or host_permissions section. — manifest.json:2-35
Can it see sensitive information you type, such as passwords, payment details, messages, or form entries?
No evidence of this behavior was found in the reviewed package.
Reads the popup todo input only after Enter and stores the resulting todo string. — scripts/script.js:77-85
Can it access private browser data such as cookies, signed-in sessions, browsing history, bookmarks, or downloads?
It stores todo strings, theme, session count, and review-prompt state in Chrome Sync.
All persisted values are ordinary todo and UI state. — scripts/script.js:46-59,77-85,139-145,298-316,324-329
Can it access anything else on your device, such as files, location, camera, microphone, clipboard, or installed applications?
No evidence of this behavior was found in the reviewed package.
The sole permission is storage. — manifest.json:29
Does it send information outside your browser? If so, what information is sent, where does it go, and why?
No evidence of this behavior was found in the reviewed package.
Only reads synchronized todos and updates the toolbar badge. — scripts/background.js:1-31
Contains no fetch, XHR, beacon, WebSocket, form submission, or remote API call. — scripts/script.js:1-338
Does it download or run code, settings, or instructions supplied by a remote server?
No evidence of this behavior was found in the reviewed package.
All behavior and UI logic are packaged locally. — scripts/script.js:1-338
Can it take actions without a clear user request, such as opening pages, redirecting searches, downloading files, or sending requests?
No evidence of this behavior was found in the reviewed package.
Install, startup, and storage-change handlers only read todos and update the badge. — scripts/background.js:1-24
Can it change important browser settings, including your proxy, search engine, homepage, privacy settings, or other extensions?
No evidence of this behavior was found in the reviewed package.
Requests no proxy, search, homepage, management, or settings permission. — manifest.json:2-35
Is any important behavior difficult to inspect because the code is hidden, heavily obfuscated, dynamically generated, or supplied by third parties?
No evidence of this behavior was found in the reviewed package.
Uses descriptive function names and straightforward DOM and storage operations. — scripts/script.js:1-338
Does it use eval(), new Function(), or string-based timers to turn text into executable code?
No evidence of this behavior was found in the reviewed package.
Timers receive function callbacks and no dynamic execution primitive appears. — scripts/script.js:1-338
Does it track the websites, pages, searches, or links you visit?
No evidence of this behavior was found in the reviewed package.
Builds a review URL from chrome.runtime.id and opens it after the visible review link is clicked. — scripts/script.js:324-337
Does it create a persistent ID or browser fingerprint to recognize you?
No evidence of this behavior was found in the reviewed package.
The session counter is stored locally only to decide when to display a review prompt. — scripts/script.js:306-337
Does it send cookies, session details, authentication data, or page contents elsewhere?
No evidence of this behavior was found in the reviewed package.
Requests only storage and no cookies or site access. — manifest.json:29
Does it record typing, form entries, clipboard contents, or screenshots?
No evidence of this behavior was found in the reviewed package.
The keyup listener is attached only to the popup's todo input and handles the Enter key. — scripts/script.js:61-95
Can a website or remote server send commands that make the extension take actions?
No evidence of this behavior was found in the reviewed package.
No remote request or server-response handler exists. — scripts/script.js:1-338
Does it alter links, referral codes, advertisements, shopping carts, or search results?
No evidence of this behavior was found in the reviewed package.
Updates the extension action badge. — scripts/background.js:26-31
DOM changes target the packaged popup document. — scripts/script.js:1-338
Does it redirect or modify web traffic, request headers, downloads, or proxy settings?
No evidence of this behavior was found in the reviewed package.
Contains the visible developer and review links. — popup/popup.html:40-50
Opens the Web Store review page after a click. — scripts/script.js:324-337
Can it communicate with software on the computer or services running on localhost?
No evidence of this behavior was found in the reviewed package.
Declares no nativeMessaging or file-related permission. — manifest.json:2-35
Does it decode, decrypt, or unpack hidden data and then execute or inject it?
No evidence of this behavior was found in the reviewed package.
Contains no network operation or remote-response handling. — scripts/script.js:1-338
Can ordinary websites access privileged extension features through messaging or exposed files?
No evidence of this behavior was found in the reviewed package.
Declares neither content scripts nor externally_connectable. — manifest.json:2-35
Does suspicious behavior activate only for certain users, websites, dates, or remote settings?
No evidence of this behavior was found in the reviewed package.
Reads and saves theme choice and hides the input when ten todos exist. — scripts/script.js:1-3,46-74,264-295
Does it perform hidden resource-intensive work, such as cryptocurrency mining?
No evidence of this behavior was found in the reviewed package.
Background work only maintains the todo-count badge. — scripts/background.js:1-31
Does it change form fields or where a form sends its information?
No evidence of this behavior was found in the reviewed package.
Assigns todoValue to a span through textContent. — scripts/script.js:148-155