Top Risks

• Free-webmail developer (gmail) with no verified business identity raises accountability concerns.
• Privacy policy admits data collection and third-party sharing but no retention period disclosed.
• install_url_hijack=true: onInstalled opens an external URL (target unknown).
• No CSP on MV3 extension contacting api.resend.com (email API) beyond stated auth scope.
• Low install count (790) + 3.3 rating with unverified developer reduces trust baseline.

Evidence

• developer_email_free_webmail store Developer email Stradaextensions@gmail.com; no verified business domain.
• install_url_hijack crx install_url_hijack=true with null target; onInstalled redirects to unknown external URL.
• privacy_policy_third_party_sharing api Policy fetched; scope_extension=true, data_collection=true, third_party_sharing=true, retention=false.
• external_host_api_resend crx Extension contacts api.resend.com (transactional email API) — not described in manifest purpose.
• no_csp manifest content_security_policy is null; no CSP declared for MV3 extension.
• low_rating store Rating 3.3; install count 790 — limited community validation.
• cve_findings_empty crx No CVEs detected in bundled JS libraries.
• code_findings_empty crx No suspicious code patterns detected; obfuscation_score=0.0.

Permissions Breakdown

• storage low Standard local data persistence for bookmark/PIN storage.
• tabs medium Can read tab URLs and titles; broader than strictly needed for a bookmark locker.
• identity medium OAuth token access; combined with googleapis host grants Google account access.
• contextMenus low Adds right-click menu entries; minimal risk.
• notifications low Desktop notifications only; low risk.
• https://accounts.google.com/* medium Host permission for Google auth; scoped but enables OAuth flows.

Pillar Scores

Bookkeeping