Top Risks

• Privacy policy is Google's generic account policy (scope_extension=false, admits data_collection+third_party_sharing) → Privacy pillar max score 10.0.
• Developer uses free webmail (gmail.com) with no verified business identity; no verified publisher badge.
• Extension contacts gasprice-proxy.herokuapp.com with no CSP; MV3 but no declared policy for outbound calls.
• Months since update = 15 months; approaching stale threshold.
• Free-webmail developer with no domain raises accountability concerns for 50K users.

Evidence

• privacy_policy_generic store Policy URL is Google account policy; scope_extension=false, data_collection=true, third_party_sharing=true → +10.0 Privacy (v3.5 rule D).
• free_webmail_developer manifest developer_email=nieldlr@gmail.com; no verified publisher, no business domain; Reputation +1.5.
• external_host_no_csp crx js_external_hosts=[gasprice-proxy.herokuapp.com]; csp_present=false; MV3 so no +2.0 MV2 penalty but outbound host noted.
• maintenance_stale store months_since_update=15; falls in 12-24mo band → +6.0 Maintenance.
• no_bad_hosts_no_cves api bad_host_hits=[], cve_findings_raw=[], affiliate_hits=[], monetization_hits=[]; no threat-intel findings.
• install_count_moderate store 50,000 installs; >10K +1.0 Webstore; no anomaly flags from install_perm_anomaly.
• code_quality_clean crx code_findings_raw=[], obfuscation_score=0.0, js_libraries_detected=[]; no malicious code indicators.
• no_operator_siblings api operator_cluster.sibling_count=0; no cluster risk.

Permissions Breakdown

• alarms low Used for periodic gas price polling; minimal risk.
• storage low Stores gas price data locally; low impact.

Pillar Scores

Bookkeeping