Top Risks

• Privacy policy is Google's generic account policy — scope_extension=false, data_collection=true, third_party_sharing=true: scores max privacy penalty.
• Brand impersonation: lists 'github' in brand_mention with is_impersonation=true; developer is unverified gmail user.
• Developer uses free webmail (gmail) with no verified business domain, raising accountability concerns.
• No CSP on MV3 extension; js_external_hosts includes webext-alert.vercel.app (third-party vercel domain).
• Low install count (1,000) with github.com content script injection limits blast radius but reduces trust signal.

Evidence

• brand_impersonation store brand_mention.is_impersonation=true for 'github'; developer is unverified gmail account, not GitHub Inc.
• generic_privacy_policy store Policy is Google account policy: scope_extension=false, data_collection=true, third_party_sharing=true.
• free_webmail_developer manifest Developer email jack16.m.u@gmail.com — no business domain, no verified publisher badge.
• no_csp crx content_security_policy=null on MV3; no CSP hardening applied.
• external_host_third_party crx js_external_hosts includes webext-alert.vercel.app — third-party vercel domain outside dev control.
• host_permissions_scoped manifest host_permissions limited to *://*.github.com/* only; no broad cross-site access.
• clean_code_scan crx code_findings_raw empty, obfuscation_score=0.0, no CVEs, no threat-intel hits.
• maintenance_borderline store months_since_update=6; falls in 3-6mo band (+1.5 maintenance score).

Permissions Breakdown

• activeTab low Grants access to current tab only on user action; scoped to github.com via host_permissions.
• contextMenus low Adds right-click menu items; low standalone risk.
• *://*.github.com/* (host) medium Content script injection on all github.com pages; scoped to single domain, not broad.

Pillar Scores

Bookkeeping