Top Risks

• Privacy policy fetched but scope_extension==false and admits data collection + third-party sharing → scores 10.0 on privacy pillar.
• manifest_source==html_fallback: no CRX parsed, so permissions/code quality are unverifiable.
• Developer name field empty; verified_publisher==false for a 6M-install security extension.
• Rating 2.9 — low for a major password manager; no rating_count available to assess severity.
• No manifest data: permission surface, content scripts, and host access completely unknown.

Evidence

• manifest_source_html_fallback store manifest_source=html_fallback; permissions, host_permissions, content_scripts all unknown — CRX not parsed.
• privacy_policy_scope_mismatch api Policy fetched (200KB), data_collection=true, third_party_sharing=true, scope_extension=false → D clause → privacy pillar 10.0.
• developer_name_missing store developer_name is empty string; verified_publisher=false despite 6M installs on a security credential manager.
• low_rating store Rating 2.9 with no rating_count supplied; cannot confirm >=50 reviews threshold for +1.0 reputation boost.
• developer_domain_healthy api 1password.com resolves=true, looks_throwaway=false, no bad_host_hits, no affiliate_hits, no monetization_hits.
• no_cve_findings api cve_findings_raw=[], js_files_scanned=0 (html_fallback); CVE pillar 0.0.
• recently_updated store last_updated June 3 2026, months_since_update=0 → maintenance pillar 0.0.
• no_operator_siblings api operator_cluster.sibling_count=0; no cluster pattern detected.

Pillar Scores

Bookkeeping