Top Risks

• Privacy policy is Google's generic policy, not scoped to this extension, yet admits data collection and third-party sharing (+10.0 privacy).
• Developer uses free Gmail address with no verified business domain, raising accountability concerns.
• Featured badge partially offsets reputation risk but developer identity remains unverifiable.
• Low install count (1,000) limits blast radius but also means limited community vetting.
• No CSP script-src remote CDN, no obfuscation, no bad hosts — technical risk is minimal.

Evidence

• privacy_policy_generic store Privacy URL points to Google's own policy (scope_extension=false, data_collection=true, third_party_sharing=true) → +10.0 privacy.
• developer_email_free_webmail store Dev email sergioacostaquintana@gmail.com; no business domain; reputation starts 5.0 +1.5 free-webmail.
• is_featured_by_google store Extension carries 'Featured' badge → -2.0 reputation.
• host_permissions_scoped manifest Host permissions limited to api.binance.com and stream.binance.com; matches stated price-tracker function.
• csp_present_mv3 manifest CSP restricts script-src to 'self'; connect-src scoped to Binance endpoints only. No unsafe-eval/inline.
• no_code_findings crx code_findings_raw empty; obfuscation_score=0.0; no eval, remote loading, or exfil indicators.
• no_threat_intel_hits api bad_host_hits, affiliate_hits, monetization_hits all empty; operator sibling_count=0.
• maintenance_3_6mo store Last updated September 2025; months_since_update=9 → maintenance score +3.5 (6-12mo band).

Permissions Breakdown

• alarms low Used for periodic price polling; minimal risk.
• storage low Local settings/portfolio data; no cross-site access.
• notifications low Price alerts; cannot exfiltrate data on its own.
• https://api.binance.com/api/v3/ticker/24hr* low Scoped to Binance price API; matches stated function.
• https://api.binance.com/api/v3/klines* low Scoped to Binance chart data; matches stated function.
• wss://stream.binance.com:9443/ws/* low WebSocket for live price feed; scoped to Binance only.

Pillar Scores

Scoring History

Bookkeeping