Top Risks

• Privacy policy is Google's generic policy (scope_extension=false, data_collection=true, third_party_sharing=true) — worst-case privacy signal.
• Developer uses free Gmail address with no verifiable business entity or domain.
• 11 external JS hosts including tradingview, github, ace.io — no CSP to constrain them (MV3 mitigates somewhat).
• Small install base (1,000) with no verified publisher; accountability gap if extension is transferred.
• No CSP declared; external hosts in 2 countries (IN, TW) with no governance transparency.

Evidence

• privacy_policy_generic store Policy URL is Google account policy; scope_extension=false, data_collection=true, third_party_sharing=true → +10.0 privacy.
• free_webmail_developer store Dev email betonimig@gmail.com; no business domain; reputation start 5.0 +1.5 webmail = 6.5.
• external_js_hosts crx 11 external hosts: ace.io, tradingview.com, github.com, gstatic.com, trends.google.com etc.; >3 distinct domains.
• no_csp manifest content_security_policy is null; MV3 applies strict-default but no explicit CSP declared.
• geo_diversity api JS hosts span 2 countries (IN, TW); below threshold of 4 for geo penalty.
• cve_findings_empty crx No CVEs detected in bundled libraries; cve_pillar_score = 0.0.
• code_findings_empty crx No malicious code patterns detected; obfuscation_score=0.0.
• maintenance_3_6mo store Last updated December 2025, 6 months ago → maintenance score +1.5.

Permissions Breakdown

• notifications medium Can push alerts to user; moderate risk, consistent with price-ticker function.
• storage low Local data persistence only; low risk.
• host: http://allcrypto.info/* medium Single third-party crypto data host; narrow scope but unverifiable reliability.

Pillar Scores

Bookkeeping