Top Risks

• Privacy policy is Google's generic account policy — not scoped to this extension; admits data collection and 3rd-party sharing.
• Brand impersonation: lists 'gitlab' as mentioned brand, developer is unverified gmail user with no confirmed ownership.
• webRequest permission on gitlab.com allows inspection of authenticated API traffic and session cookies in requests.
• innerHTML DOM-XSS sink in main.js with no CSP; could be exploited if content source is attacker-controlled.
• Free-webmail developer (gmail) with no business website; no verified publisher badge increases supply-chain risk.

Evidence

• brand_impersonation store brand_mention.is_impersonation=true for 'gitlab'; developer is gmail user with no confirmed ownership.
• generic_privacy_policy store Privacy URL is Google account policy; scope_extension=false, data_collection=true, third_party_sharing=true → +10.0 privacy.
• free_webmail_developer store Developer email svendepondt@gmail.com; no business domain; not verified publisher.
• webRequest_high_perm manifest webRequest declared against https://gitlab.com/* — can observe authenticated GitLab traffic.
• dom_xss_sink crx dom_sink_innerhtml_userctrl in assets/main.js; no CSP present, raising effective risk per FIX B.
• no_csp manifest content_security_policy is null on MV3 extension; amplifies DOM-XSS and network risks.
• small_install_high_perm api install_perm_anomaly.small_install_high_perm=true; 655 installs with webRequest HIGH-tier permission.
• no_bad_hosts_or_affiliates crx threat_intel shows no bad_host_hits, affiliate_hits, or monetization_hits; js_external_hosts limited to github/gitlab/vuejs.

Permissions Breakdown

• activeTab low Scoped to user-initiated interaction; low ambient risk.
• alarms low Scheduling only; no data access.
• notifications low Can show desktop notifications; low risk standalone.
• webRequest high Can observe all requests to gitlab.com; sensitive traffic inspection.
• scripting medium Programmatic script injection into pages; meaningful capability.
• storage low Local extension storage only.
• https://gitlab.com/* medium Scoped to single domain; appropriate for stated function but still broad on that domain.

Pillar Scores

Bookkeeping