Please report a security problem in this module or in Hazelchat to hello@hazelchat.co, with "Security" in the subject. We answer within one business day and fix confirmed problems in a new release.

The module prints one script tag with your public widget key, which is not a password. The script address is fixed in the code and cannot be changed in the settings. The module makes no requests from ProcessWire, stores only the key and one switch in the module's settings, and only superusers (or roles with module-admin) can change them.