I am looking into using some add-on that automated a mail merge from Google Spreadsheet data, via Google Doc templates, to PDFs that get emailed out.

Several add-ons that I looked into (such as autocrat) require, when attempting to install them, extensive permissions including full access to all of my Drive files and the ability to send email as me.

What kind of risks are there in installing such an add-on? Can it e.g. email back to its developers sensitive files from my Drive? And how can I mitigate some/all of these risks? (E.g. is it possible to extract the add-on source, verify it doesn't contain any funny stuff, and then install my own version of it?)

  • Have you learned anything about this. I'm surprised there's no answer yet.
    – orome
    Sep 20 '16 at 15:24
  • nothing yet I'm afraid :(
    – GJ.
    Sep 20 '16 at 21:02
  • It could not email sensitive files from your drive, as a sandbox prevents accessing most areas of the disk. However it could transmit everything you do in the browser to anyone it wants.
    – forest
    Feb 25 '18 at 6:57

If a tool requires extensive rights, then yes, it can use them. If the tool has full read access to your hard drive, it can indeed see your sensitive data and send it to the creators of the software.

To mitigate this, you can look for software that needs few permissions, and restrict the software as much as possible.

You could do this by setting up a separate account for the mail merge software. This has the added advantage that you can have the mail come from a different name than you. (E.g. "Tennis Club" instead of "G.J."). Making it clear to recipients that it is not you personally, but the entity on whose behalf you are running the mail merge.

Apart from restricting the rights, you could run the software in a VM or (ideally) on a separate machine. That is still no guarantee, malware can escape a VM sometimes; there was a vulnerability allowing that, a few years ago.

If the software insists on being installed with admin/root privileges, then you'll want to run it in a VM.


I had the same question. Here are some thoughts I found. https://spinbackup.com/blog/security-risks-google-add-ons/

The gist is these are not made by Google and therefore there is always some risk. In fact it sounds a bit like apps on a phone, except seemingly without any Google recommendations.

  • Even if it was made by Google, that is no guarantee. Aside from the chance that someone at Google might be a blackhat, there could simply be vulnerabilities that they overlooked.
    – S.L. Barth
    Feb 23 '18 at 19:37

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.