Top Risks

• Privacy policy fetched but scope_extension==false and third_party_sharing==true; policy not scoped to this extension.
• Content script runs on mail.google.com; can access Gmail page content.
• declarativeNetRequestWithHostAccess allows network request modification on declared hosts.
• No developer display name in listing; developer identity relies on email domain only.
• No CSP declared (MV3 mitigates somewhat, but absent explicit policy raises review flag).

Evidence

• privacy_policy_scope_mismatch api Policy at doist.com/privacy: fetched=true, scope_extension=false, data_collection=true, third_party_sharing=true — triggers D clause (+10.0 privacy).
• gmail_content_script manifest content_scripts_matches includes mail.google.com; scripting permission enables JS injection into Gmail.
• declarativeNetRequestWithHostAccess manifest HIGH-tier permission can intercept/modify requests to todoist.com and mail.google.com.
• featured_by_google store is_featured_by_google=true; -2.0 reputation discount applied.
• no_bad_hosts_no_cves api threat_intel.bad_host_hits empty, cve_findings_raw empty, obfuscation_score=0, code_findings_raw empty.
• developer_domain_healthy api todoist.com resolves=true, looks_throwaway=false, no affiliate/monetization hits.
• install_count_high store 500,000 installs; +1.0 webstore (>100k), -0.5 popularity-as-trust (rating 4.7 >=4.0).
• no_operator_siblings api operator_cluster.sibling_count=0; no cluster risk.

Permissions Breakdown

• storage low Standard local data persistence; low risk.
• tabs medium Can read tab URLs and titles; moderate info exposure.
• contextMenus low Adds right-click menu items; low risk.
• declarativeNetRequestWithHostAccess high Can modify/block network requests on declared hosts; significant capability.
• webNavigation medium Observes navigation events across tabs; moderate info exposure.
• scripting medium Can inject scripts into pages matching host_permissions.
• http://*.todoist.com/* medium Scoped to own service domain; expected for productivity app.
• https://*.todoist.com/* medium Scoped to own service domain; expected for productivity app.
• http://mail.google.com/* high Content script on Gmail; can read email page content.
• https://mail.google.com/* high Content script on Gmail; can read email page content.

Pillar Scores

Bookkeeping