Top Risks

• Extension not updated in 26 months — stale and unpatched against any future vulnerabilities.
• Brand mention of 'reddit' flagged as impersonation by scanner; developer is not a confirmed Reddit owner.
• Privacy policy discloses third-party sharing without scoping retention; lacks data-retention clause.
• No CSP declared (MV3 mitigates partially but content scripts run on reddit.com without explicit policy).
• developer_domain resolves and appears legitimate (tomjwatson.com), but is_featured badge reduces concern.

Evidence

• is_featured_by_google store Extension carries Google 'Featured' badge, indicating basic policy compliance review.
• months_since_update=26 store Last updated April 2024; 26 months stale triggers +8.5 maintenance score.
• brand_mention.is_impersonation=true store Scanner flagged 'reddit' brand mention; confirmed_owner=false. Developer not verified as Reddit Inc.
• privacy_policy third_party_sharing=true, retention=false api Policy fetched, scoped to extension, discloses data collection and 3rd-party sharing but no retention clause.
• no_cve_findings crx No CVEs detected in bundled JS libraries; cve_findings_raw is empty.
• code_findings_raw empty, obfuscation_score=0.0 crx No suspicious code patterns detected; clean JS scan across 2 files.
• threat_intel clean api No bad_host_hits, affiliate_hits, or monetization_hits; developer domain resolves and not throwaway.
• host_permissions narrow manifest Content scripts limited to https://*.reddit.com/*/comments/* — tightly scoped to stated function.

Permissions Breakdown

• storage low Stores user preferences locally; no data exfiltration risk on its own.
• https://*.reddit.com/ (host_permission) low Scoped exclusively to reddit.com; matches stated function of collapsing Reddit comments.

Pillar Scores

Bookkeeping