Top Risks

• Brand impersonation: Discord mentioned but developer is unaffiliated third party
• Privacy policy admits data collection and third-party sharing without extension scope
• Free Gmail developer email with no verified business entity despite publisher verification
• CSP allows unrestricted connect-src (*) enabling exfiltration to any domain

Evidence

• verified_publisher_and_featured store Google-verified publisher and featured badge present
• brand_impersonation api Mentions Discord brand but developer is unaffiliated (jinchaoh@gmail.com)
• privacy_policy_inadequate api Policy fetched but scope_extension=false, admits data_collection and third_party_sharing
• free_webmail_developer store Developer uses Gmail address with no business domain
• csp_broad_connect crx CSP connect-src allows * (any origin), enabling potential data exfiltration
• recent_maintenance store Updated 2 months ago, actively maintained
• clean_code_scan crx No suspicious code patterns, obfuscation score 0.0, 8 JS files scanned
• narrow_permissions crx Minimal permission set, host access limited to Discord and Gumroad API

Permissions Breakdown

• scripting medium Allows dynamic script injection into Discord pages to extract chat data
• activeTab low Access to currently active tab, scoped by user activation
• storage low Local storage for extension settings and state
• alarms low Schedule periodic tasks, minimal risk
• https://api.gumroad.com/* low License validation endpoint, narrow scope
• https://discord.com/* medium Access to Discord web app, required for chat export function
• https://*.discord.com/* medium Wildcard access to Discord subdomains, slightly broad

Pillar Scores

Bookkeeping