Top Risks

• Privacy policy fetched but does not scope to this extension and data_collection==false yields +9.0 privacy pillar — policy inadequate for enterprise.
• No CSP declared (MV3 so no +2.0 network penalty, but no explicit script-src protection).
• 5 distinct external JS hosts (all blocknative-owned) raises minor network breadth signal.
• Rating 3.9 with unknown review count; no verified-publisher badge reduces reputation confidence.
• Maintenance at 3-6 months boundary; continued monitoring recommended.

Evidence

• permissions_minimal manifest Only 'storage' declared; no host_permissions, no content_scripts. Very low capability surface.
• no_csp manifest content_security_policy is null. MV3 default applies; no explicit script-src hardening.
• external_hosts_all_first_party crx 5 external hosts: api.blocknative.com, bnc-assets.com, docs.blocknative.com, explorer.blocknative.com, www.blocknative.com — all blocknative-owned.
• privacy_policy_not_extension_scoped api Policy fetched (20 KB), scope_extension==false, data_collection==false → +9.0 privacy per FIX A.
• no_bad_hosts_no_affiliate_no_monetization api threat_intel shows zero bad/affiliate/monetization hits; developer domain resolves, not throwaway.
• featured_by_google store is_featured_by_google==true; no verified_publisher badge. Provides moderate trust signal.
• no_code_findings_no_obfuscation crx code_findings_raw empty, obfuscation_score 0.0; 4 JS files scanned cleanly.
• cve_none crx cve_findings_raw empty; no CVE exposure.

Permissions Breakdown

• storage low Local key-value store only; no cross-origin or user-data exfil risk.

Pillar Scores

Bookkeeping