Top Risks

• Instagram follower marketplace violates Instagram ToS (fake engagement)
• Brand impersonation: uses Instagram trademark without authorization
• Developer uses free Gmail with no verifiable business identity
• Privacy policy is generic and not scoped to this extension's data practices
• Extension injects scripts into Instagram.com to automate social actions

Evidence

• brand_impersonation api brand_mention.is_impersonation=true, uses Instagram trademark, not verified owner
• developer_identity store Free Gmail (jmbonipro@gmail.com), no developer name, no business website, no verified badge
• instagram_automation manifest Host permissions + content scripts on instagram.com for follower marketplace (ToS violation)
• privacy_policy_gap api privacy_policy_classification: scope_extension=false, data_collection=false - generic policy
• low_adoption store Only 8 installs, no ratings, minimal social proof
• firebase_backend manifest Uses Google Cloud Functions + Firebase Auth (identitytoolkit, securetoken) for backend
• no_code_findings crx code_findings_raw empty, obfuscation_score=0.0, no malicious patterns detected
• staleness store months_since_update=6, last updated April 2026

Permissions Breakdown

• activeTab low User-initiated access to active tab only
• tabs medium Can view tab URLs and browser state
• storage low Local data storage only
• scripting medium Can inject scripts into permitted hosts
• alarms low Background timing operations
• notifications low Browser notifications
• https://www.instagram.com/* medium Content script access to Instagram platform
• https://instagram.com/* medium Content script access to Instagram platform
• https://europe-west1-boostfollow-saas.cloudfunctions.net/* low First-party backend API
• https://boostfollow.me/* low First-party website
• https://boostfollow-saas.web.app/* low First-party hosting

Pillar Scores

Bookkeeping