No material or high-risk concern was identified in this review.
This advisory report describes what the named tools and contextual reviewer found at one exact commit. Unknown or unobserved behavior may still exist.
0 high0 material3 low
What this review found
No material or high-risk item was identified.
Expected scanner matches (3)
Gitleaks reported generic-api-key
Expected behavior · high confidence
This is a public identifier, not a password or secret key. It is normal for OAuth client IDs to be visible in source code, and this one matches the identifier used by the official Claude CLI.
Technical evidence
Scanner reason: Gitleaks matched secret-detection rule generic-api-key in this repository.
Contextual assessment: The flagged value is a UUID-format string assigned to OAUTH_CLIENT_ID, a public OAuth client identifier, not a secret credential. OAuth client IDs are designed to be embedded in client applications and exchanged publicly during authorization flows. The surrounding comments confirm this is the same client_id the Claude Code CLI uses, and it is used to refresh tokens against the platform token endpoint. No secret material is exposed.
Credential access and network transmission in one file
Expected behavior · high confidence
The extension reads your saved Claude login token and uses it to ask Anthropic's own service how much of your subscription quota you have used. This is exactly what the quota display feature is supposed to do, and the token is only sent to Anthropic, not anywhere else.
Technical evidence
Scanner reason: A credential source and an outbound network operation were detected in the same file.
Contextual assessment: The flagged code reads a locally stored OAuth access token and sends it as a Bearer credential to a usage/quota endpoint. This matches the project's stated purpose of providing a live subscription quota meter. The token is used to authenticate against the expected provider API, is not transmitted to any third-party or unexpected destination, and the request includes a timeout. No exfiltration, obfuscation, or off-purpose data flow is present.
This is a public identifier for the Claude app, not a password or secret key. It tells the Anthropic login system which application is asking to refresh a login session. It is normal for this kind of identifier to be visible in the code, and it is only ever sent to Anthropic's own login service.
Technical evidence
Scanner reason: Gitleaks matched secret-detection rule generic-api-key in this repository.
Contextual assessment: The matched value is a UUID-format OAuth client identifier embedded as a constant. It is used solely as the client_id parameter in token-refresh requests to the Anthropic platform token endpoint. OAuth client IDs for public CLI/desktop clients are designed to be shipped in client code and are not secrets; only the corresponding access and refresh tokens (read from the local credentials file at runtime) are sensitive. The code comment confirms this is the same client_id the Claude Code CLI itself uses. No exfiltration, obfuscation, or alternate destination is present.