Top Risks

• Privacy policy admits data collection & 3rd-party sharing without scoping to this extension — scores max privacy risk.
• Brand impersonation: 'Discord' mentioned by unverified gmail dev; confirmed_owner=false.
• No CSP + 4x innerHTML DOM-XSS sinks elevate DOM injection risk in extension UI.
• External Supabase endpoint (zjtlssppxzesxvhwokje.supabase.co) contacted — unknown data sent to cloud DB.
• Dev email is numbered-alias gmail with no verified business identity; developer_name blank.

Evidence

• brand_impersonation store brand_mention.is_impersonation=true, brands=['discord'], confirmed_owner=false, dev domain=gmail.com.
• privacy_policy_max_risk api scope_extension=false, data_collection=true, third_party_sharing=true → +10.0 per v3.5 rule D.
• no_csp crx content_security_policy=null; MV3 default applies but DOM-XSS sinks increase exposure without explicit policy.
• dom_xss_sinks crx 4 files contain dom_sink_innerhtml_userctrl; no CSP present → +2.0 per FIX B.
• external_supabase_host crx js_external_hosts includes zjtlssppxzesxvhwokje.supabase.co — cloud DB endpoint with unknown data scope.
• gmail_dev_no_name store developer_email=summer25934930@gmail.com (numbered alias), developer_name=''; free webmail + no identity.
• verified_publisher_featured store verified_publisher=true AND is_featured_by_google=true; mitigates reputation but capped under 0c (monetization check N/A).
• host_permissions_discord_scoped manifest Host permissions limited to discord.com/* and cdn.discordapp.com/*; narrow scope matches stated function.

Permissions Breakdown

• storage low Local data persistence; low risk on its own.
• scripting medium Can inject scripts; scoped to discord.com host permission only.
• tabs medium Can read tab URLs and titles across browser; moderate risk.
• https://discord.com/* medium Host access scoped to Discord; reads/injects into Discord sessions.
• https://cdn.discordapp.com/* low CDN asset access scoped to Discord's CDN; read-only media.

Pillar Scores

Bookkeeping