Its own grade

Graded B, by the same rules as every plugin.

Zotero Atlas is listed and graded on zoteroplugins.org by the same pipeline as the other plugins. Nothing on its card is edited by hand.

What puts it at B

Use with care

Read why before installing

Three findings put it at B, and all three are the point of the plugin:

mediumSends usage data to zoteroatlas.com. Under the catalogue's rules, a plugin that can send usage data to its developer's server rates "medium", whether the sending is opt-in or not. Atlas can, so it does.

mediumInstalls other add-ons. Installing software is a powerful capability, and the rules rate it medium however carefully it is done: here from a hash-checked catalogue, after asking you.

mediumChanges other plugins. Holding another plugin's update, or turning one off, rates medium for every plugin that does it. Atlas holds updates only if you choose to, and turns a plugin off only when you click "Turn it off".

lowEverything else came out low: readable code uploaded by the project's own GitHub build, updates from the project's repository, no credentials stored, and it works with the current Zotero.

An A would need all three gone, which means a plugin that installs nothing, changes nothing and can report nothing. We would rather say plainly what it does and take the B. It is the grade we would give anyone else with the same code.

We did not bend the rules for ourselves. The grade is computed by the same pipeline, from the same release file, with the same thresholds as the other plugins, and the card carries a note that the catalogue's own team makes it. If a rule ever changes, the change applies to every plugin and shows up in the public grade log.

What we hold to

Nothing about you

It never sends your library, notes, files, Zotero account, email or anything that identifies you. There is no account, no sign-in, and no identifier that could be tied back to a person.

One list, and your choice

The only thing it sends unasked is your list of installed plugins, and only while "Send my plugin list", the default, is chosen. Pick "Don't send", at first run or any time later, and it sends nothing more and asks the server to delete the record. Privacy

Install what was checked

Every install carries the hash of the file the catalogue analysed. If the file at the address has changed since, Zotero refuses it. That closes the gap between "we read this" and "you installed that".

The same rules as everyone

Atlas is listed and graded on zoteroplugins.org by the same pipeline as the other plugins. Nothing on its card is edited by hand, and the card says who makes it.

Nothing hidden

The plugin is a few plain JavaScript files zipped as they are, with nothing compiled or bundled. Anyone can rebuild it byte for byte from the tagged source, and each release carries GitHub's build attestation. The server's code is public too.

Kept private

What people choose to send is never published. We read it as counts: how many installs report, and how many have each plugin. That tells us which plugins people actually use, and it can't tell us who.

Check what you install

The 1.0.1 file's SHA-256 is 7e5bc3efd5cd2a817592e5241d7c4711ca3e774a131bc0797efa4364446848df.

Unzip and compare

The .xpi is a zip of the files in the repository's src/ folder, unchanged. Rename it to .zip if your computer won't open it and compare with the tagged source.

Rebuild it

python3 build.py on the tagged commit makes a byte-identical file on any system. Compare its SHA-256 with the download's.

Check where it was built

Each release is built by the public release workflow from the tagged commit and carries GitHub's attestation: gh attestation verify <file> --repo iliasbeshimov/zotero-atlas.