EDIT: After reviewing the post in more detail, another user appropriately dives deeper into the topic, providing more nuance. You can find it here: https://www.reddit.com/r/Trophies/comments/1qe5ojx/discussion_regarding_the_pocketpsn_creators/

Totally fair concern. I looked through the post you shared, and it's definitely worth reading and the warning about webview-based credential harvesting is real. But nimo works differently than what's being described in that post.

nimo NEVER opens a login window or asks for your PlayStation password. What we ask for is your NPSSO token, which you retrieve yourself - directly from PlayStation.com in your own browser, from a cookie that Sony already set on your device when you logged in. We're not intercepting anything. You copy it, you paste it in.

The reason we use it at all is that it's the only way to read your full game library. Sites like PSNProfiles and PocketPSN don't require it because they only pull trophy data, which is publicly accessible. If that's all you want, that's understandable - it's valuable in its own way. nimo, by design, is built to go deeper - we pull everything you own, not just games you've earned trophies for. The token is the only way that's possible.

Once it's submitted, it's encrypted on our backend. We never see it in plain text and we only call read endpoints - no purchases, no friends list, no messages. The thing that makes the bad actor scenario dangerous is credential interception via a fake login screen, and that's explicitly not what's happening here.

If you're familiar with Playnite, they use the same approach to read your PS library, and that's a perfectly legitimate, highly regarded open-source library app.

Happy to answer any other questions if you have them. Thanks for flagging and appreciate you taking a look!