Top Risks

• Privacy policy is Google's generic account policy — not scoped to this extension, admits data collection and third-party sharing.
• Developer uses free Gmail address with no verified business domain; identity unverifiable.
• No CSP declared (MV3 mitigates but adds +2.0 to Network under MV2 rule; not applicable here — scored as 2.0 for absent CSP network risk).
• Very low install count (561) limits blast radius but also means minimal community scrutiny.
• Featured badge reduces reputation concern but does not eliminate free-webmail developer risk.

Evidence

• permissions_minimal manifest Only storage and contextMenus declared; no host permissions or HIGH-tier permissions.
• privacy_policy_generic store Policy URL is Google account policy; scope_extension=false, data_collection=true, third_party_sharing=true → +10.0 privacy.
• developer_email_gmail store Developer email yigitsereflioglu48@gmail.com is free webmail; no business domain verifiable.
• featured_by_google store is_featured_by_google=true; applies -2.0 Reputation discount.
• no_csp manifest content_security_policy is null; MV3 provides some default protection.
• no_bad_hosts_no_cve crx cve_findings_raw=[], bad_host_hits=[], js_external_hosts=[]; no malicious indicators.
• no_obfuscation crx obfuscation_score=0.0; code_findings_raw empty; 2 JS files scanned cleanly.
• recently_updated store months_since_update=1; maintenance score=0.0.

Permissions Breakdown

• storage low Saves notes locally; expected for a note-taking extension.
• contextMenus low Adds right-click menu entries; low standalone risk.

Pillar Scores

Bookkeeping