Top Risks

• Developer name field is empty; reduces accountability signal despite verified publisher status.
• Privacy policy discloses third-party sharing without scoping which data; adds minor concern.
• react@16.14.0 bundled; below 16.4 threshold not triggered, but older minor version in use.
• 1M installs means broad blast radius if extension were ever compromised or transferred.
• CSP host-set fingerprint matches 19 other extensions; cluster warrants awareness.

Evidence

• verified_publisher store Verified publisher badge present; developer domain sessionbuddy.com resolves and is not throwaway.
• is_featured_by_google store Google Featured badge present; follows recommended practices.
• permissions_scope manifest Only tabs, storage, unlimitedStorage, alarms; no host_permissions, no broad URL access.
• csp_strict crx CSP: script-src 'self'; object-src 'self' — no unsafe-eval, no remote CDN.
• code_quality crx code_findings_raw empty; obfuscation_score 0.0; no exfil or eval patterns detected.
• privacy_policy api Policy fetched, scoped to extension, data_collection false, retention true; third_party_sharing true adds +1.0.
• threat_intel_clean api No bad_host_hits, no affiliate_hits, no monetization_hits; single JS external host: github.com.
• maintenance_current store Last updated April 28, 2026; 2 months since update — maintenance pillar 0.0.

Permissions Breakdown

• tabs medium Allows reading tab URLs/titles; core to session manager function.
• unlimitedStorage low Permits large local storage; reasonable for saving many sessions.
• storage low Basic key-value storage; low risk, no remote exfil path.
• alarms low Scheduled callbacks; low risk, used for auto-save features.

Pillar Scores

Bookkeeping