Top Risks

• Privacy policy is Google's generic account policy — no extension-specific scope, collection disclosure, or retention terms.
• Developer uses free webmail (outlook.com) with no verified business identity.
• Extension is 24 months stale — at the 24-month maintenance threshold (+6.0).
• No CSP declared (MV3 mitigates somewhat but adds minor network uncertainty).
• 12 external JS hosts contacted, including raw.githubusercontent.com and Steam — wide reach for a small site-enhancement tool.

Evidence

• privacy_policy_generic api Policy URL is Google account policy; scope_extension=false, data_collection=true, third_party_sharing=true → Privacy pillar +10.
• developer_email_free_webmail store Developer email tors-backloggery-extension@outlook.com is free webmail; no verified business domain.
• maintenance_stale store Last updated June 24 2024; months_since_update=24 → Maintenance +6.0.
• no_csp crx content_security_policy is null; MV3 default provides some protection but no explicit CSP.
• external_hosts_wide crx 12 external hosts including raw.githubusercontent.com, store.steampowered.com, chart.apis.google.com.
• no_bad_host_hits api threat_intel bad_host_hits, affiliate_hits, monetization_hits all empty — no malicious network signals.
• no_code_findings crx code_findings_raw empty; obfuscation_score=0.0 — no suspicious code patterns detected.
• narrow_content_scripts crx Content scripts scoped to backloggery.club and backloggery.com only — matches stated function.

Permissions Breakdown

• content_scripts: backloggery.com/backloggery.club low Scoped narrowly to backloggery domains; matches stated function of site enhancements.

Pillar Scores

Bookkeeping