Top Risks

• Privacy policy fetch failed; cannot confirm extension data handling scope.
• webRequest + <all_urls> + content_scripts on all URLs gives broad traffic observation capability.
• No CSP declared (MV3 mitigates but external host popper.js.org still contacted).
• Privacy policy is generic Reddit platform policy, not extension-scoped.
• Developer confirmed as reddit.com owner; risk substantially mitigated by brand confirmation.

Evidence

• confirmed_owner store brand_mention.confirmed_owner=true; developer_domain=reddit.com resolves, not throwaway.
• broad_host_permissions manifest host_permissions include <all_urls> and *://*.google.com/ with content_scripts on all URLs.
• webrequest_all_urls manifest webRequest + <all_urls> enables full traffic inspection across all sites.
• privacy_policy_fetch_failed api privacy_policy_classification.fetched=false; fetch_error:HTTPError; policy unverifiable.
• external_hosts crx js_external_hosts: alb.reddit.com (first-party), popper.js.org (third-party CDN).
• no_csp manifest content_security_policy=null; MV3 provides default CSP but no custom hardening.
• featured_by_google store is_featured_by_google=true; follows recommended practices badge present.
• clean_code_scan crx code_findings_raw=[], obfuscation_score=0.0, cve_findings_raw=[], no threat-intel hits.

Permissions Breakdown

• webRequest high Intercepts all network requests; paired with <all_urls> host access amplifies risk.
• tabs medium Access to tab URLs and metadata across all open tabs.
• <all_urls> high Broad host permission granting access to every site visited.
• *://*.google.com/ medium Explicit Google host permission; redundant under <all_urls> but signals deliberate targeting.
• content_scripts http://*/*, https://*/* high Content scripts injected on every page; effectively universal reach.

Pillar Scores

Bookkeeping