Is monday CRM safe?
We analyzed monday CRM version 0.0.17's actual code and gave it a 55/100 trust score. This is a purpose-aligned CRM extension with broad…
Bottom line
This is a purpose-aligned CRM extension with broad communication-site access, account-data handling, and limited evidence of unnecessary tracking or security risk.
What it can access
It can read contact details across Gmail, Calendar, and Outlook and handle Monday account data, which fits CRM use but is broad and sensitive.[Q1][Q2][Q4]
Security weaknesses
Handling account cookies and inspecting Gmail traffic creates meaningful misuse risk, while large minified bundles make independent review difficult.[Q10][Q14][Q18]
Signs of misuse
It sends CRM data and account-linked activity to Monday and telemetry providers, including linked identifiers and email-related metadata.[Q6][Q13]
Code findings
What access does this extension ask for, and does that access make sense for what it claims to do?
It requests cookies, storage, scripting, activeTab, sidePanel, and persistent access to Monday production/staging/local-development domains plus Gmail, Google Calendar, and Outlook. Automatic page access run on all three communication services.
Declares the sensitive permissions and automatic Gmail/Calendar/Outlook integrations. — manifest.json:permissions, host_permissions, and content_scripts
Which websites can it run on, and can it read or change what appears on those pages?
It scans Gmail messages, Calendar dialogs, and Outlook people/recipient UI for names and email addresses and inserts CRM buttons. Gmail also receives a packaged main-world script that integrates with its internal page and request flows.
Finds sender spans carrying name/email and inserts a monday CRM button beside opened Gmail messages. — assets/chunk-DARN7o_B.js:Gmail registerMessageViewHandler integration
Observes Calendar dialogs, extracts attendee email/name attributes, and injects CRM buttons. — assets/chunk-BKDqO-xc.js:entire file
Observes Outlook person elements, extracts name/email text, and injects CRM buttons. — assets/chunk-CtfhOKHP.js:entire file
Uses chrome.scripting.executeScript in MAIN world to load packaged pageWorld.js into Gmail. — assets/chunk-DlsTleyZ.js:inboxsdk__injectPageWorld listener
Can it see sensitive information you type, such as passwords, payment details, messages, or form entries?
It reads names and email addresses from opened Gmail messages and visible Calendar/Outlook people UI. Those are personal contact details, but the reviewed Monday call site does not read email bodies, passwords, payment forms, or arbitrary typed fields.
Reads name and email attributes from the visible message sender element. — assets/chunk-DARN7o_B.js:monday Gmail integration near registerMessageViewHandler
Extracts email addresses from Calendar hovercard attributes and derives attendee names. — assets/chunk-BKDqO-xc.js:attendee extraction
Parses Outlook person text/aria labels for name and email. — assets/chunk-CtfhOKHP.js:person extraction
Can it access private browser data such as cookies, signed-in sessions, browsing history, bookmarks, or downloads?
It reads Monday cookies, creates an extension CSRF cookie, and stores CRM workspace/board settings, a short-lived service token, selected contact data, side-panel state, and temporary name/email values in chrome.storage.local.
Reads Monday cookies, sets extensionSessionKey, and wraps chrome.storage.local. — assets/chunk-D48_RtJj.js:te, Or, oc, ic, dr, and cc functions
Caches a minted CRM service token with expiration. — assets/chunk-DlsTleyZ.js:crmServiceToken cache
Loads and clears temporary side-panel tab, item, email, name, and timestamp values. — assets/chunk-KuYbTtZZ.js:SidePanelBody storage handoff
Can it access anything else on your device, such as files, location, camera, microphone, clipboard, or installed applications?
No evidence of this behavior was found in the reviewed package.
Declares none of the device/native capabilities and no localhost host. — manifest.json:permissions and host_permissions
Does it send information outside your browser? If so, what information is sent, where does it go, and why?
It sends names/email addresses and user-entered CRM fields or notes to the signed-in Monday account for record lookup and modification. It also sends account-linked feature events to track.bigbrain.me, error context to Sentry, and InboxSDK Gmail activity events to InboxSDK's Google Pub/Sub pipeline.
Passes visible name/email in GetEntity and side-panel messages after the user clicks. — assets/chunk-Bf3S2k05.js:CRM button click handler
Posts itemData, contact/company/note content, associations, and CRM queries to Monday endpoints. — assets/chunk-DlsTleyZ.js:Q, X, Z, and action handlers
Posts events with Monday account/user IDs and event properties to BigBrain and initializes Monday's Sentry DSN. — assets/chunk-D48_RtJj.js:tc.sendBigBrainEvent and Sentry initialization
Sends SDK errors and queued Gmail events containing session/email hashes and metadata to InboxSDK-operated services. — assets/chunk-DARN7o_B.js:InboxSDK error/event logger
Does it download or run code, settings, or instructions supplied by a remote server?
No evidence of this behavior was found in the reviewed package.
Loads a fixed packaged service-worker chunk. — service-worker-loader.js:1
Dynamically imports a fixed chrome.runtime.getURL packaged Gmail chunk. — assets/index.tsx-loader-B9zdY0b7.js:entire file
Passes an embedded animationData object to the Lottie player. — assets/chunk-KuYbTtZZ.js:Loader component
Can it take actions without a clear user request, such as opening pages, redirecting searches, downloading files, or sending requests?
It automatically scans supported page DOMs, reads Monday login state, emits installation/language and SDK telemetry, and maintains injected controls. Searching or modifying CRM records begins from visible CRM-button or side-panel actions rather than occurring silently for every displayed person.
Continuously rescans Calendar dialogs and injects buttons. — assets/chunk-BKDqO-xc.js:MutationObserver setup
Continuously rescans Outlook person elements. — assets/chunk-CtfhOKHP.js:MutationObserver setup
Automatically adds buttons to opened Gmail messages. — assets/chunk-DARN7o_B.js:InboxSDK message handler
Starts CRM lookup and opens the side panel only on a user click. — assets/chunk-Bf3S2k05.js:CRM button click handler
Can it change important browser settings, including your proxy, search engine, homepage, privacy settings, or other extensions?
No evidence of this behavior was found in the reviewed package.
Contains no search/new-tab/proxy/management override. — manifest.json:top-level fields
Enables opening the declared side panel when the action is clicked. — assets/chunk-DlsTleyZ.js:service-worker startup
Is any important behavior difficult to inspect because the code is hidden, heavily obfuscated, dynamically generated, or supplied by third parties?
Important behavior is spread across roughly 7.4 MB of minified React, Monday CRM/UI, InboxSDK, Sentry, and Lottie bundles without source maps. services and relevant call paths remain recoverable, but complete independent review is difficult.
Lists a 5.4 MB side-panel bundle, 1 MB Gmail bundle, 577 KB pageWorld script, and supporting chunks. — inventory.json:files
Combines the minified side-panel application with many large dependencies. — assets/chunk-KuYbTtZZ.js:entire file
Does it use eval(), new Function(), or string-based timers to turn text into executable code?
No evidence of this behavior was found in the reviewed package.
Uses new Function with fixed generated wrapper/global source. — pageWorld.js:defn wrapper and webpack global runtime
Contains equivalent new Function calls in the packaged Gmail SDK. — assets/chunk-DARN7o_B.js:InboxSDK defn and webpack runtime
Calls eval on Lottie expression val; the reviewed Loader passes bundled animationData. — assets/chunk-KuYbTtZZ.js:Lottie expression_function
Does it track the websites, pages, searches, or links you visit?
No evidence of this behavior was found in the reviewed package.
Builds BigBrain events with event name/properties, UUID, pulse_account_id, and pulse_user_id. — assets/chunk-D48_RtJj.js:tc.track
Builds and periodically uploads timestamped SDK events with sessionId and emailHash. — assets/chunk-DARN7o_B.js:InboxSDK De event builder and Pub/Sub flush
Does it create a persistent ID or browser fingerprint to recognize you?
Monday telemetry includes stable Monday account and user IDs plus a fresh UUID per event. InboxSDK separately attaches a session ID and deterministic hash of the Gmail address, allowing activity to be linked to an account without sending its plain address to InboxSDK telemetry.
Reads platform account/user cookie values and includes them in BigBrain events. — assets/chunk-D48_RtJj.js:Or and tc.track
Hashes the email with an inboxsdk prefix and attaches emailHash/sessionId to queued events. — assets/chunk-DARN7o_B.js:InboxSDK at and De functions
Does it send cookies, session details, authentication data, or page contents elsewhere?
The cookies permission reads Monday account/user/last-login cookies and confirms a JWT session cookie on the selected account subdomain. It then fetches a CSRF token, stores extensionSessionKey as a secure Monday cookie, mints a short-lived CRM service token, and makes credentialed requests.
Reads Monday cookies, derives the account base URL, creates the CSRF cookie, and sends credentialed requests. — assets/chunk-D48_RtJj.js:te, Or, oc, ic, cr, and ur functions
Mints and caches crmServiceToken for selected CRM calls. — assets/chunk-DlsTleyZ.js:Y and B token functions
Does it record typing, form entries, clipboard contents, or screenshots?
It reads visible sender or attendee names and email addresses from Gmail, Calendar, and Outlook. The reviewed product call sites do not capture message bodies, typed drafts, clipboard contents, screenshots, camera, or microphone data.
Extracts name/email attributes from a sender span in an opened message. — assets/chunk-DARN7o_B.js:Gmail monday integration
Reads visible Calendar attendee emails/names. — assets/chunk-BKDqO-xc.js:attendee extraction
Reads visible Outlook person name/email data. — assets/chunk-CtfhOKHP.js:person extraction
Can a website or remote server send commands that make the extension take actions?
No evidence of this behavior was found in the reviewed package.
No externally_connectable entry is declared. — manifest.json:top-level fields
Handles a fixed set of packaged runtime action names. — assets/chunk-DlsTleyZ.js:action handler map
Does it alter links, referral codes, advertisements, shopping carts, or search results?
No evidence of this behavior was found in the reviewed package.
Renders a branded CRM view button tied to contact lookup. — assets/chunk-Bf3S2k05.js:CRM button component
Does it redirect or modify web traffic, request headers, downloads, or proxy settings?
The Gmail integration injects packaged pageWorld.js into the page's MAIN world, wraps XMLHttpRequest, and parses Gmail request/response metadata such as thread/message IDs, recipients, dates, and CSRF-related headers for InboxSDK. The Monday feature uses sender identity, but the SDK layer has broader visibility into Gmail traffic.
Injects pageWorld.js into the sender tab/frame's MAIN world. — assets/chunk-DlsTleyZ.js:inboxsdk__injectPageWorld listener
Wraps XMLHttpRequest and extracts message/thread metadata, recipients, dates, and Gmail request tokens. — pageWorld.js:XHR wrapper and Gmail request processors
Can it communicate with software on the computer or services running on localhost?
No evidence of this behavior was found in the reviewed package.
No nativeMessaging or loopback host is declared. — manifest.json:permissions and host_permissions
Does it decode, decrypt, or unpack hidden data and then execute or inject it?
No evidence of this behavior was found in the reviewed package.
Active Lottie source is the bundled animationData object. — assets/chunk-KuYbTtZZ.js:Loader component and Lottie expression engine
Parses Monday responses as JSON for fixed application handlers. — assets/chunk-D48_RtJj.js:cr and ur request functions
Can ordinary websites access privileged extension features through messaging or exposed files?
No evidence of this behavior was found in the reviewed package.
Exposes fixed chunks to the three supported site families with use_dynamic_url disabled. — manifest.json:web_accessible_resources
Dynamically imports the exposed packaged Gmail chunk through chrome.runtime.getURL. — assets/index.tsx-loader-B9zdY0b7.js:entire file
Does suspicious behavior activate only for certain users, websites, dates, or remote settings?
No evidence of this behavior was found in the reviewed package.
Selects documented production/staging/development Monday domains and stored CRM workspace/board state. — assets/chunk-D48_RtJj.js:environment and settings selection
Does it perform hidden resource-intensive work, such as cryptocurrency mining?
No evidence of this behavior was found in the reviewed package.
Observes the entire Calendar body subtree and schedules rescans with requestAnimationFrame. — assets/chunk-BKDqO-xc.js:MutationObserver
Observes the entire Outlook body subtree and schedules rescans. — assets/chunk-CtfhOKHP.js:MutationObserver
Does it change form fields or where a form sends its information?
No evidence of this behavior was found in the reviewed package.
Collects CRM fields/notes and sends fixed add actions after Save. — assets/chunk-KuYbTtZZ.js:AddContactState and AddNoteView
Maps explicit side-panel actions to Monday CRM write endpoints. — assets/chunk-DlsTleyZ.js:AddContact, AddCompany, AddNote, and association handlers