Top Risks

• Privacy policy is Google's generic account policy (scope_extension=false, data_collection=true, third_party_sharing=true) — no extension-specific disclosure.
• Extension last updated 25 months ago; stale maintenance raises supply-chain risk.
• No developer name listed in store; reduces accountability.
• MV3 with no CSP declared; minor gap though MV3 provides some defaults.
• Low install count (1,000) with 25-month staleness limits community scrutiny.

Evidence

• privacy_policy_generic store Privacy URL points to Google account policy; scope_extension=false, data_collection=true, third_party_sharing=true — triggers +10.0 per v3.5 rule D.
• maintenance_stale store Last updated May 2024; months_since_update=25 — falls in 24-36mo band (+8.5).
• verified_publisher_featured store verified_publisher=true AND is_featured_by_google=true; reputation discounts applied, hard floor 2.0.
• developer_domain_established api super-productivity.com age ~3030 days, 113 certs since 2018-02-26; not new or throwaway.
• no_cve_no_bad_hosts crx cve_findings_raw empty; threat_intel bad_host_hits, affiliate_hits, monetization_hits all empty.
• narrow_content_scripts manifest Content scripts scoped only to app.super-productivity.com and super-productivity.com/app/*.
• no_obfuscation_no_code_findings crx obfuscation_score=0.0; code_findings_raw empty; clean JS scan.
• no_csp_mv3 manifest content_security_policy=null; MV3 provides defaults so no v2 +2.0 MV2 penalty applied.

Permissions Breakdown

• tabs medium Can read tab URLs/titles; moderate sensitivity for a productivity app.
• idle low Detects user idle state; low impact, common for productivity tools.
• content_scripts(*://app.super-productivity.com/*, *://super-productivity.com/app/*) low Scoped narrowly to own domain only; minimal host-access risk.

Pillar Scores

Scoring History

Bookkeeping