Top Risks

• Privacy policy is Google's generic account policy — does not scope to this extension, admits data collection and 3rd-party sharing (+10.0 privacy pillar).
• Brand impersonation: mentions 'reddit' in name/brand but developer is unverified free-webmail individual (+2.0 reputation).
• Developer uses free Gmail; no verified publisher badge or business domain raises accountability gap.
• Uninstall URL hijack flag set (uninstall_url_hijack=true) though target is null; warrants confirmation.
• 6 distinct JS external hosts (reddit.com, svelte.dev, troddit.com, mozilla.org, chromiumapp.org) slightly broad for a notifier.

Evidence

• brand_impersonation store brand_mention.is_impersonation=true; developer is unverified gmail user, not Reddit Inc.
• privacy_policy_generic api Policy is myaccount.google.com; scope_extension=false, data_collection=true, third_party_sharing=true → +10.0 privacy.
• uninstall_url_hijack crx uninstall_url_hijack=true; target=null. Flag present but destination unresolved.
• free_webmail_dev store developer_email=flytaly@gmail.com; no business domain; no verified publisher badge.
• js_external_hosts crx 6 external hosts: reddit.com, old.reddit.com, svelte.dev, troddit.com, mozilla.org, chromiumapp.org.
• cve_findings_raw_empty crx No CVEs detected; cve_findings_raw=[].
• code_findings_clean crx code_findings_raw=[]; obfuscation_score=0.0; no malicious patterns found.
• is_featured_by_google store Extension carries Google Featured badge, providing moderate reputation discount.

Permissions Breakdown

• identity low OAuth token access; scoped to user consent, no broad data grab.
• storage low Local data persistence only.
• alarms low Scheduling periodic checks; no data access.
• notifications low Display notifications; no data exfil path.
• unlimitedStorage low Larger local storage quota; low risk alone.
• offscreen low Background DOM task; MV3 pattern, limited surface.
• https://*.reddit.com/* medium Host access to all reddit.com subdomains; matches stated function.

Pillar Scores

Bookkeeping