The extension sends the user's Spotify Client ID to Spotify's own official login server as part of a standard sign-in process. This is exactly how Spotify's authentication is supposed to work and does not expose any secrets to anyone other than Spotify.
Technical evidence
Scanner reason: OpenGrep matched static-analysis rule tavernkeeper.credential-exfiltration.javascript-secret-to-network in this repository.
Contextual assessment: The fetch call to the official Spotify token endpoint implements a standard OAuth2 PKCE authorization-code exchange. The client_id is a public OAuth2 identifier, not a secret, and is expected to be sent in the token request body per the Spotify Web API specification. The code_verifier is an ephemeral PKCE value retrieved from localStorage and used once for this exchange. The destination is Spotify's official accounts API, the data flow matches the stated optional Spotify API authentication feature, and no credentials are sent to any third-party or unexpected endpoint.
Credential access and network transmission in one file
Expected behavior · high confidence
The extension reads the user's Spotify Client ID and sends it to Spotify's official servers to complete the login process. This is the normal, expected behavior for connecting to Spotify and does not send any credentials anywhere unexpected.
Technical evidence
Scanner reason: A credential source and an outbound network operation were detected in the same file.
Contextual assessment: This candidate flags the co-occurrence of credential access and network transmission in the same file. The credential in question is the OAuth2 client_id stored in extension settings, and the network sink is the official Spotify token endpoint. In a PKCE flow, the client_id is a public identifier intentionally transmitted to the authorization server's token endpoint. The code_verifier from localStorage is also sent to the same official endpoint as required by the PKCE specification. No credentials are transmitted to any non-Spotify destination, and the behavior is fully consistent with the documented optional Spotify API authentication feature.