Is Communication Center by CliniqApps safe?
We analyzed Communication Center by CliniqApps version 1.5.3's actual code and gave it a 55/100 trust score. This is a purpose-aligned healthcare…
Bottom line
This is a purpose-aligned healthcare communication extension, but its all-site reach and exposed signed-in interface create meaningful privacy and security risk.
What it can access
It can run on every website and handle healthcare messages and files, while sending them to its own service; this fits its purpose but is broader than needed. [Q1][Q3][Q6]
Security weaknesses
Any website may frame the signed-in extension interface, creating a clickjacking risk, though arbitrary code execution was not found. [Q21]
Signs of misuse
No evidence shows advertising, credential theft, or unrelated collection; data sent to CliniqApps supports its stated communication features. [Q6][Q14][Q17]
Code findings
What access does this extension ask for, and does that access make sense for what it claims to do?
It requests tabs, storage, notifications, activeTab, scripting, alarms, offscreen operation and access to every website. Notifications, storage and background live updates support the product, but all-sites scripting is broader than necessary for its supported practice-management integrations.
Grants all-URL host access, injects a content script on all URLs and declares tabs, storage, notifications, activeTab, scripting, alarms and offscreen permissions. — manifest.json:14-20, 48-70
Offers Everywhere and Only in my PMS display choices, with Everywhere selected when no saved choice exists. — assets/Account.b065810b.js:1
Which websites can it run on, and can it read or change what appears on those pages?
It adds a draggable launcher and extension-owned iframe to webpages. By default this occurs everywhere; users can restrict it to CliniqApps, Cliniko, Nookal and CorePlus sites.
Creates the floating launcher and an iframe whose source is packaged index.html, with a local supported-host check for the restricted setting. — content.js:199-321, 359-443
Page listeners manage closing, dragging, positioning and reinserting the extension UI; they do not extract page contents or input values. — content.js:113-131, 482-559
Can it see sensitive information you type, such as passwords, payment details, messages, or form entries?
Users enter healthcare notes, emails, SMS messages, faxes, chat messages and account credentials into the extension's own UI. These values are sent to CliniqApps for the requested communication.
Builds note, email, SMS, fax and form payloads from the extension's editor and selected patient/contact. — assets/Editor.6bba936f.js:1-4
Sends username and password to CliniqApps login-ext, then stores the returned user details and access token. — assets/index.html.cbb23ce6.js:1-2
Serializes local records as JSON, converts bytes with btoa and stores the reversible Base64 text in chrome.storage.local without cryptography. — assets/useMessaging.450fc40a.js:1
Can it access private browser data such as cookies, signed-in sessions, browsing history, bookmarks, or downloads?
No evidence of this behavior was found in the reviewed package.
Declares no cookies, history, bookmarks, browsingData or downloads permission. — manifest.json:62-70
Obtains access_token from the successful CliniqApps login response and uses it in CliniqApps API payloads. — assets/index.html.cbb23ce6.js:1
Can it access anything else on your device, such as files, location, camera, microphone, clipboard, or installed applications?
Users can select files to attach to notes, email, fax and chat messages; files under 15 MB are uploaded to CliniqApps. No background access to arbitrary files, camera, microphone, location, clipboard, screen capture or native applications was found.
Reads files only from the extension's file input and passes the selected files to uploadFiles. — assets/Editor.6bba936f.js:4
Uploads selected files to type-specific CliniqApps attachment endpoints and enforces a 15 MB application limit. — assets/index.html.cbb23ce6.js:1
Declares no capture, geolocation, clipboard, camera, microphone or native-messaging permission. — manifest.json:62-70
Does it send information outside your browser? If so, what information is sent, where does it go, and why?
It sends patient/contact details, messages, notes, files, tasks, waitlists, account IDs and its access token to ma-bc.cliniqapps.com and associated CliniqApps live-update services. This is highly sensitive healthcare data, but the destinations and purposes match the connected communication product; unrelated advertising or analytics recipients were not found.
Implements CliniqApps APIs for communications, contacts, patient forms, notes, chat, tasks, waitlists and attachment uploads. — assets/index.html.cbb23ce6.js:1-2
Uses the CliniqApps mobile API and an AWS WebSocket endpoint for account-scoped task, chat and communication updates. — assets/background.6556be47.js:1
Builds authenticated WebSocket connections from the configured host, company, user, access token and chat token. — assets/offscreen.49c986f4.js:1
Does it download or run code, settings, or instructions supplied by a remote server?
CliniqApps supplies patient records, messages, tasks, templates, settings and live events that determine what the extension displays and which product actions are available. That is expected client/server behavior.
Consumes structured API responses for product records, forms, templates and settings. — assets/index.html.cbb23ce6.js:1-2
Parses authenticated WebSocket JSON into named chat and communication events. — assets/offscreen.49c986f4.js:1
Can it take actions without a clear user request, such as opening pages, redirecting searches, downloading files, or sending requests?
Sending communications, changing tasks and waitlists, uploading files and starting calls require visible user actions. After login, background services automatically maintain presence, retrieve unread counts, receive live healthcare communication events and show notifications.
Automatically maintains authenticated live connections, presence, unread counts and desktop notifications after login. — assets/background.6556be47.js:1
Provides notification settings, availability controls and a do-not-disturb timer. — assets/Account.b065810b.js:1
Builds and submits communication payloads from explicit composer and send actions. — assets/Editor.6bba936f.js:1-4
Can it change important browser settings, including your proxy, search engine, homepage, privacy settings, or other extensions?
No evidence of this behavior was found in the reviewed package.
Declares no browser-settings, search, proxy or privacy permission. — manifest.json:62-70
Is any important behavior difficult to inspect because the code is hidden, heavily obfuscated, dynamically generated, or supplied by third parties?
Most application code is minified Vite/Vue output with readable route, field and services names; an unminified copy of the all-sites page access is also packaged. No deliberate packing or encrypted executable data was found.
Lists modular Vue application chunks, an unminified content.js and corresponding generated content bundle. — inventory.json:1
The storage writer logs 'Error encrypting data' but only applies JSON, TextEncoder and btoa. — assets/useMessaging.450fc40a.js:1
Does it use eval(), new Function(), or string-based timers to turn text into executable code?
No evidence of this behavior was found in the reviewed package.
Parses API and WebSocket payloads into fixed event handlers without evaluating them as code. — assets/background.6556be47.js:1
Contains bundled application and libraries but no matching dynamic JavaScript execution primitive. — assets/index.html.cbb23ce6.js:1-50
Does it track the websites, pages, searches, or links you visit?
No evidence of this behavior was found in the reviewed package.
Uses hostname locally for display eligibility and reacts to navigation only to maintain the extension UI. — content.js:235-243, 423-443, 561-568
isClinikoPatientPage queries the active tab, requires a cliniko.com hostname and extracts only the numeric /patients/{id} path segment for the user-started waitlist workflow. — assets/index.html.cbb23ce6.js:2
Does it create a persistent ID or browser fingerprint to recognize you?
Requests and live connections carry the signed-in user ID, company ID and access or chat token so CliniqApps can authenticate the account. These are service identifiers, not a device fingerprint or unexplained cross-site tracking ID.
Defines default CliniqApps payload data from company_id, user_id and access_token. — assets/index.html.cbb23ce6.js:1-2
Authenticates WebSocket connections with the account's company, user, access and chat identifiers. — assets/offscreen.49c986f4.js:1
Does it send cookies, session details, authentication data, or page contents elsewhere?
Patient/contact records, communications, notes, tasks, waitlists, selected files and the CliniqApps access token go to the CliniqApps service the user signed into. This is sensitive healthcare data but normal product behavior, not evidence of credential theft.
Uses the account token with CliniqApps endpoints for patient/contact communications, chat, tasks, waitlists, forms and uploads. — assets/index.html.cbb23ce6.js:1-2
Caches application records by applying reversible Base64 to JSON and storing it in chrome.storage.local. — assets/useMessaging.450fc40a.js:1
Sends entered username/password only to the HTTPS CliniqApps login-ext endpoint and stores the returned service token. — assets/index.html.cbb23ce6.js:1
Does it record typing, form entries, clipboard contents, or screenshots?
It collects text and selected attachments entered into its own healthcare communication editors, then sends them after the user's submit action. It does not monitor webpage typing, read arbitrary forms, capture screenshots or read the clipboard.
Reads its own contenteditable note/email/SMS/fax editor, recipient fields and file input to construct a communication payload. — assets/Editor.6bba936f.js:1-4
The webpage content script manages only extension UI position and visibility and has no input, keylogging, clipboard or capture collection. — content.js:113-131, 199-321, 482-559
Can a website or remote server send commands that make the extension take actions?
Authenticated CliniqApps services and WebSocket events update patient communications, chats, tasks, presence and notification state. They cannot instruct the extension to execute arbitrary code or manipulate the surrounding website.
Parses authenticated WebSocket events and forwards structured messages to the background worker. — assets/offscreen.49c986f4.js:1
Routes named server events through fixed task, chat, patient and communication update handlers and notifications. — assets/background.6556be47.js:1
Does it alter links, referral codes, advertisements, shopping carts, or search results?
No evidence of this behavior was found in the reviewed package.
Adds only the CliniqApps launcher and extension iframe to host pages. — content.js:199-443
Does it redirect or modify web traffic, request headers, downloads, or proxy settings?
No evidence of this behavior was found in the reviewed package.
Declares no proxy, webRequest, declarativeNetRequest or downloads permission. — manifest.json:62-70
Uploads files selected in the extension UI to fixed CliniqApps attachment endpoints. — assets/index.html.cbb23ce6.js:1
Can it communicate with software on the computer or services running on localhost?
No evidence of this behavior was found in the reviewed package.
Defines the public HTTPS CliniqApps API and WSS AWS API Gateway endpoint. — assets/background.6556be47.js:1
Declares no nativeMessaging permission. — manifest.json:62-70
Does it decode, decrypt, or unpack hidden data and then execute or inject it?
No evidence of this behavior was found in the reviewed package.
Uses btoa/atob, TextEncoder/TextDecoder and JSON parse/stringify solely for local record storage. — assets/useMessaging.450fc40a.js:1
Can ordinary websites access privileged extension features through messaging or exposed files?
The manifest exposes index.html, all JavaScript, CSS, images, audio, content.js and offscreen.html to every website. An arbitrary site can therefore frame the authenticated extension app and potentially overlay it for clickjacking.
Lists the app shell and broad resource wildcards as web-accessible to all URLs with stable URLs. — manifest.json:21-46
Loads the full privileged application and contains no frame-ancestor restriction or frame-busting check. — index.html:1-24
Contains no externally_connectable configuration. — manifest.json:1-84
The extension itself embeds the authenticated index.html app in an iframe on host pages, confirming that framing is an active design path. — content.js:359-410
Does suspicious behavior activate only for certain users, websites, dates, or remote settings?
No evidence of this behavior was found in the reviewed package.
Displays the two launcher-scope choices and persists selectedDisplayMode. — assets/Account.b065810b.js:1
Defaults the display mode to Everywhere and enforces the named practice-management host list only when restricted mode is selected. — content.js:21, 89-106, 235-243, 423-443
Does it perform hidden resource-intensive work, such as cryptocurrency mining?
No evidence of this behavior was found in the reviewed package.
Creates an offscreen document and a one-minute keepAlive alarm for WebSocket continuity. — assets/background.6556be47.js:1
Sends a fixed internal ping once per second to maintain the extension port. — content.js:27-49
Does it change form fields or where a form sends its information?
No evidence of this behavior was found in the reviewed package.
The all-sites script creates and manages extension-owned elements without querying or rewriting host-page forms. — content.js:113-131, 199-321, 359-443
All note, message and recipient fields are components within the extension application. — assets/Editor.6bba936f.js:1-4