Is Notes: Keep Sticky Thoughts in Google Drive safe?
We analyzed Notes: Keep Sticky Thoughts in Google Drive version 26.9.6's actual code and gave it a 76/100 trust score. This is a mostly purpose-aligned…
Bottom line
This is a mostly purpose-aligned notes extension with moderate access, an unsolicited promotional tab, and a minor input-handling weakness.
What it can access
It can store and send note text to Google Drive, but has no access to ordinary websites, browsing history, cookies, or device hardware.[Q1][Q3][Q6]
Security weaknesses
A title returned from Google Drive is inserted into the note list without escaping, creating a potential content-injection weakness despite browser safeguards.[Q16]
Signs of misuse
After an update, it opens a Manganum promotional page without a current user request, but no broader data misuse is established.[Q8][Q6]
Code findings
What access does this extension ask for, and does that access make sense for what it claims to do?
It requests identity, storage and access to Google's services host. Its OAuth grant is the limited `drive.file` scope, which allows access to Drive files created by the app or explicitly opened with it rather than the user's entire Drive.
Declares identity and storage, Google APIs host access and the https://www.googleapis.com/auth/drive.file OAuth scope. — manifest.json:17-44
Uses the OAuth token for Drive file, folder, export, upload and trash operations. — service_worker.js:2
Which websites can it run on, and can it read or change what appears on those pages?
No evidence of this behavior was found in the reviewed package.
Contains no content_scripts, scripting, tabs or all-sites host permission; its only host permission is www.googleapis.com. — manifest.json:17-44
Can it see sensitive information you type, such as passwords, payment details, messages, or form entries?
It handles whatever private text the user types into a note, including note titles and rich-text content. That data is stored in the user's Google Drive and cached locally for the advertised feature.
Reads editor HTML after user text changes and sends title/content to the saveContent background request. — popup.js:2
Caches note content locally and uploads it as HTML to the app's Google Drive folder. — service_worker.js:2
Can it access private browser data such as cookies, signed-in sessions, browsing history, bookmarks, or downloads?
No evidence of this behavior was found in the reviewed package.
Declares identity and storage but not cookies, history, bookmarks or downloads. — manifest.json:17-44
Obtains authentication through chrome.identity.getAuthToken and adds it as a Bearer token to Google API requests. — service_worker.js:2
Can it access anything else on your device, such as files, location, camera, microphone, clipboard, or installed applications?
No evidence of this behavior was found in the reviewed package.
Requests only identity, storage and the Google API host. — manifest.json:17-44
Does it send information outside your browser? If so, what information is sent, where does it go, and why?
Note titles and HTML content, folder/file metadata and the Google OAuth token are sent to Google Drive services to synchronize the user's notes. The package also links to get.manganum.app for promotion, update and uninstall pages, but no note data or token is attached to those links.
Sends Bearer-authenticated Drive v2 metadata, export, upload and trash requests to www.googleapis.com. — service_worker.js:2
Contains a visible promotional link to get.manganum.app. — popup.html:93-98
Uses get.manganum.app only as fixed update/uninstall navigation URLs, without note payloads. — service_worker.js:2
Does it download or run code, settings, or instructions supplied by a remote server?
Google Drive supplies document metadata and exported HTML that the extension displays. The HTML body is passed through a tag/attribute/style allowlist before reaching the editor, and remote responses are not used as JavaScript.
Downloads Drive document exports, sanitizes them to a small formatting allowlist and caches the result as note content. — service_worker.js:2
Converts the sanitized cached HTML through Quill before displaying it in the editor. — popup.js:2
Can it take actions without a clear user request, such as opening pages, redirecting searches, downloading files, or sending requests?
On every extension update, the service worker opens a new tab to `https://get.manganum.app/ORDm` without a contemporaneous user request. This is confirmed unsolicited promotion, not malware or data theft.
The onInstalled listener checks for UPDATE and unconditionally calls chrome.tabs.create with the Manganum URL. — service_worker.js:2
Automatically sends edited note content to the local/background save queue after user text changes. — popup.js:2
Can it change important browser settings, including your proxy, search engine, homepage, privacy settings, or other extensions?
No evidence of this behavior was found in the reviewed package.
Declared permissions do not include proxy, search-provider or browser-settings control. — manifest.json:17-44
Is any important behavior difficult to inspect because the code is hidden, heavily obfuscated, dynamically generated, or supplied by third parties?
The popup, options and worker bundles are minified and include large older libraries such as jQuery and Quill, making review harder. Minification is not evidence of abuse, and the small permission/network surface remained traceable.
A roughly 740 KB minified bundle includes the note UI and third-party editor libraries. — popup.js:1-2
A roughly 166 KB minified bundle contains the complete background Drive flow. — service_worker.js:1-2
Does it use eval(), new Function(), or string-based timers to turn text into executable code?
No evidence of this behavior was found in the reviewed package.
Reviewed Drive request and retry code uses callback functions rather than strings. — service_worker.js:1-2
Extension CSP permits scripts only from the packaged extension itself. — manifest.json:45-47
Does it track the websites, pages, searches, or links you visit?
No evidence of this behavior was found in the reviewed package.
Has no content-script, tabs or history access. — manifest.json:17-44
Background work is limited to Drive note synchronization and fixed update/uninstall navigation. — service_worker.js:2
Does it create a persistent ID or browser fingerprint to recognize you?
No evidence of this behavior was found in the reviewed package.
Generates local note UUID-like values with Math.random and stores Drive server IDs solely to synchronize documents. — service_worker.js:2
Does it send cookies, session details, authentication data, or page contents elsewhere?
A Google OAuth Bearer token, note titles and note HTML are sent to Google Drive, the intended service. The token is obtained from Chrome Identity and is not included in Manganum or Chrome Web Store navigations.
Sets Authorization: Bearer with the Chrome Identity token on Google Drive requests and uploads note title/content to Google's API. — service_worker.js:2
On sign-out, removes cached auth and asks Google's OAuth revoke endpoint to invalidate the token. — options.js:2
Does it record typing, form entries, clipboard contents, or screenshots?
The extension reads text typed into its own note editor and automatically sends the updated note to Google Drive. This is the advertised core feature.
The Quill text-change handler reads editor HTML, derives a title and sends saveContent after user edits. — popup.js:2
No content-script, clipboard or screenshot permission is declared. — manifest.json:17-44
Can a website or remote server send commands that make the extension take actions?
No evidence of this behavior was found in the reviewed package.
Copies the Drive API's file title into cached document objects and returns them to the popup. — service_worker.js:2
Ri constructs a notes-list entry with the template `<p>${e.title}</p>` and passes it to jQuery as HTML without escaping. — popup.js:2
The script-src self CSP is a meaningful safeguard against inline or remote injected script, but it does not prevent all injected UI or image loads. — manifest.json:45-47
Does it alter links, referral codes, advertisements, shopping carts, or search results?
No evidence of this behavior was found in the reviewed package.
Displays a Manganum productivity-extension banner and a five-star rating prompt. — popup.html:93-105
Automatically opens the Manganum update URL and configures another Manganum URL for uninstall. — service_worker.js:2
Shows the rating dialog after increasing open-count thresholds and opens the Web Store review page when accepted. — popup.js:2
Does it redirect or modify web traffic, request headers, downloads, or proxy settings?
No evidence of this behavior was found in the reviewed package.
Does not declare proxy, webRequest, declarativeNetRequest or downloads. — manifest.json:17-44
Can it communicate with software on the computer or services running on localhost?
No evidence of this behavior was found in the reviewed package.
Requests no nativeMessaging or local-network capability and limits host access to Google's API. — manifest.json:17-44
Does it decode, decrypt, or unpack hidden data and then execute or inject it?
No evidence of this behavior was found in the reviewed package.
Processes downloaded note HTML through a formatting sanitizer and stores the resulting data rather than executing it. — service_worker.js:2
Can ordinary websites access privileged extension features through messaging or exposed files?
No evidence of this behavior was found in the reviewed package.
Defines no web_accessible_resources, externally_connectable or content_scripts entries. — manifest.json:17-47
Internal runtime messages operate on cached note IDs and the extension's Drive scope. — service_worker.js:2
Does suspicious behavior activate only for certain users, websites, dates, or remote settings?
No evidence of this behavior was found in the reviewed package.
Registers fixed Drive note handlers plus a deterministic UPDATE navigation. — service_worker.js:2
Provides no general website access on which selective targeting could operate. — manifest.json:17-44
Does it perform hidden resource-intensive work, such as cryptocurrency mining?
No evidence of this behavior was found in the reviewed package.
Prevents creation beyond 100 notes. — popup.js:2
Lists up to 100 Drive documents and staggers metadata/content requests with short callback timers. — service_worker.js:2
Does it change form fields or where a form sends its information?
No evidence of this behavior was found in the reviewed package.
No ordinary-site content script or scripting permission exists. — manifest.json:17-44
Form-like input handling is confined to the packaged Quill note editor and popup controls. — popup.js:2