Top Risks

• Search provider override to greatstartapp.com hijacks all browser searches — core monetization surface.
• Privacy policy URL (becovi.com) failed to fetch; no meaningful data handling disclosure exists.
• Developer uses free webmail (outlook.com) with no verified business identity or domain.
• Extension is 23 months stale with 30K installs — abandoned but still active in the wild.
• Privacy policy domain (becovi.com) differs from extension domain (greatstartapp.com) — mismatched identity.

Evidence

• search_provider_override manifest chrome_settings_overrides sets is_default=true, routing searches to greatstartapp.com/serp.php.
• privacy_policy_fetch_failed api becovi.com/privacy.php returned HTTPError; policy is inaccessible — scored as fetched==false.
• free_webmail_developer store Developer email greatstartlab@outlook.com; no verified business domain or publisher badge.
• staleness store Last updated September 2024; 23 months since update with 30K active installs.
• privacy_domain_mismatch store Privacy policy on becovi.com; extension operates under greatstartapp.com — unrelated domains.
• no_js_files crx js_file_count=0, code_findings_raw empty; extension is purely manifest-driven search override.
• no_rating store Rating is 0 with 30K installs — no credible user feedback signal available.
• manifest_localized_strings manifest manifest_name and manifest_description use __MSG_ placeholders — actual content not visible in manifest.

Permissions Breakdown

• chrome_settings_overrides.search_provider medium Overrides default search engine to greatstartapp.com — hijacks all user searches silently.

Pillar Scores

Bookkeeping