Top Risks

• Privacy policy is a generic Google account page — unfetched, unscoped, no extension-specific disclosures.
• Free-webmail developer (gmail.com) with no verified business identity.
• manifest_source is html_fallback — actual permissions unknown, cannot rule out undisclosed capabilities.
• Privacy policy link fetched with SSLError; actual data handling practices unverifiable.
• No code scanned (0 JS files); risk surface from installed code is entirely opaque.

Evidence

• manifest_source_html_fallback store manifest_source=html_fallback; no CRX parsed — permissions, host_permissions, content_scripts all unknown.
• privacy_policy_fetch_failed api Privacy policy URL points to Google account policy; fetch failed SSLError; scope_extension=false, data_collection=false.
• free_webmail_developer store Developer email nermincandas@gmail.com — free webmail, no business domain, no verified publisher badge.
• low_install_count store 605 installs — small user base limits blast radius but also reduces accountability signals.
• no_code_scanned crx js_files_scanned=0, code_findings_raw empty, obfuscation_score=0.0 — code surface entirely opaque.
• no_bad_hosts_or_monetization api threat_intel bad_host_hits, monetization_hits, affiliate_hits all empty; no geo-diversity concerns.
• recently_updated store months_since_update=2; maintenance pillar low risk.
• no_cve_findings api cve_findings_raw empty; CVE pillar score 0.0.

Pillar Scores

Bookkeeping