You're very wise.

There can be risk without buying though.

The reason I made this was the session app, which is praised by people in the security/privacy space. But it also runs on a 'token' 🤔

Not necessarily trashing on them but I need to look further into it because I find that a worry.