Top Risks

• Privacy policy is Google's generic account policy — not scoped to this extension; admits data collection and third-party sharing.
• Developer uses free-webmail (gmail) with no verified business identity, raising accountability concerns.
• Install URL hijack opens third-party site (whatifoff.github.io) on install — low-grade but noteworthy monetization signal.
• No Content Security Policy; MV3 default is strict but absence noted alongside external JS hosts.
• Extension contacts external hosts (vuejs.org, whatifoff.github.io) with no declared host_permissions — unclear scope.

Evidence

• privacy_policy_generic store Policy is Google's own account policy (scope_extension=false, data_collection=true, third_party_sharing=true). Triggers +10.0 Privacy under v3.5 rule D.
• free_webmail_dev store Developer email whatifoff@gmail.com; no verified business. Reputation start 5.0 +1.5 = 6.5.
• install_url_hijack crx onInstalled opens https://whatifoff.github.io/memo-notepad-site/ — Webstore +2.0.
• external_js_hosts crx 3 external hosts in js_external_hosts: docs.google.com, vuejs.org, whatifoff.github.io — Network +1.5.
• no_csp manifest content_security_policy is null; MV3 so no +2.0 Network penalty, but CSP-absent noted.
• code_clean crx code_findings_raw empty, obfuscation_score 0.0 — Code Quality 0.0.
• maintenance_3_6mo store months_since_update=12, falls in 6-12mo band → +3.5 Maintenance.
• cve_none crx cve_findings_raw empty; CVE pillar 0.0.

Permissions Breakdown

• storage low Expected for a notepad app saving user content locally.
• notifications low Can push browser notifications; low risk without host access.

Pillar Scores

Bookkeeping