osmoscraft / tundra Goto Github PK

The extension uses local storage API to store sensitive credentials locally on the user's machine. However, the token is stored as plaintext in LevelDB file (.ldb). The token can be easily extracted using Linux CLI utilities such as "strings" and "grep". A recommendation approach is to adopt GitHub's OAuth integration to authorize the interaction with GitHub. This will reduce the need to store the token permanently.