Top Risks

• No fetchable privacy policy despite broad ticket-site access and Amplitude analytics
• 23 months without update; ticket sites change frequently, suggesting abandonment
• No content_security_policy declared in MV3 manifest
• Developer domain sametix.com does not resolve
• 11 external host permissions including analytics and social platforms

Evidence

• privacy_policy_missing store Privacy policy URL present but fetch failed (ConnectionError); no data handling disclosure.
• maintenance_stale store Last updated November 2024, 23 months ago; ticket sites require frequent selector updates.
• csp_missing crx content_security_policy is null; no CSP protections for extension pages.
• developer_domain_dead api threat_intel.developer_domain_info.resolves == false for sametix.com.
• analytics_host crx host_permissions includes *.amplitude.com; js_external_hosts includes api2.amplitude.com.
• install_hijack crx install_url_hijack true; redirects to sametix.com/sametix-install-successful/ (own domain, low risk).
• permissions_scoped crx host_permissions limited to major ticketing platforms; consistent with stated price-comparison function.
• code_findings_empty crx code_findings_raw and cve_findings_raw are empty; no malicious patterns detected.

Permissions Breakdown

• storage low Local data persistence, low risk.
• unlimitedStorage low Extended storage quota, low risk.
• host_permissions medium Scoped to ticketing domains matching stated function.

Pillar Scores

Bookkeeping