Top Risks

• Extension abandoned 52 months ago (>36 mo); any future update could silently alter search behavior for 3,000 users.
• Default search override routes all user queries to developer-controlled domain (searchingsafely.com) with tracking params (p=3400,v=400).
• Developer uses free Gmail address with no verified business identity; no developer name listed.
• Privacy policy fetched but does not scope to this extension or disclose data collection; third-party sharing silent.
• Verified-publisher badge on a deeply stale, Gmail-dev extension with opaque search monetization parameters.

Evidence

• search_provider_override manifest chrome_settings_overrides sets searchingsafely.com as default search with p=3400&v=400 monetization params.
• extreme_staleness store Last updated May 2022; 52 months since update — well beyond 36-month zombie threshold.
• free_webmail_developer store Developer email searchingsafely.ltd@gmail.com is a free Gmail account; no developer name provided.
• privacy_policy_not_extension_scoped api Policy fetched (97KB) but scope_extension=false, data_collection=false; third_party_silence=true.
• verified_publisher_discount_capped store Verified publisher badge, but 0c cap applies: months_since_update=52 >18; discount capped at -1.0.
• no_js_files crx js_file_count=0, code_findings_raw empty, obfuscation_score=0; extension is pure manifest search override.
• webstore_search_provider_override manifest Search override is a MEDIUM-risk permission (+1.0) per rubric; scored under Permissions pillar.
• no_cve_findings crx cve_findings_raw is empty; no bundled JS libraries detected.

Permissions Breakdown

• chrome_settings_overrides.search_provider medium Overrides default search engine to searchingsafely.com; redirects all queries to developer-controlled domain.

Pillar Scores

Bookkeeping