Top Risks

• Privacy policy fetched but scope_extension=false and third_party_sharing=true with no retention info — scored at 10.0.
• No developer name listed; email-only identity with own domain but no verified publisher badge.
• 3 innerHTML DOM-XSS sink findings with no CSP present increases injection risk.
• Geolocation permission sends precise user location to rain-alarm.com servers.
• 12 external JS hosts with no CSP; geo-diversity spans CA/IE/IN.

Evidence

• privacy_policy_generic api Policy fetched but scope_extension=false, data_collection=false, third_party_sharing=true, retention=false → privacy pillar 10.0.
• no_developer_name store developer_name is empty string; only email web@rain-alarm.com available. +1.0 reputation.
• dom_xss_no_csp crx 3 innerHTML findings in options.js, leaflet.js, soundmanager2 with csp_present=false → code quality +2.0.
• geolocation_permission manifest Geolocation declared; location sent to app.rain-alarm.com for weather queries.
• no_csp_mv3 manifest content_security_policy is null; MV3 has strict default but no explicit CSP declared.
• is_featured_by_google store Featured badge present — reduces reputation risk.
• no_bad_hosts api threat_intel.bad_host_hits empty, affiliate_hits empty, monetization_hits empty.
• host_geo_diversity api JS hosts span 3 countries (CA, IE, IN); below +1.5 threshold of 4.

Permissions Breakdown

• alarms low Schedules periodic checks for rain — core function.
• geolocation medium Reads precise user location; needed for rain detection but sensitive PII.
• notifications medium Can push notifications; combined with geolocation raises privacy concern.
• background low Keeps service worker alive for alarm checks.
• storage low Stores user preferences locally.
• offscreen low Used for audio playback of rain alarm sounds.
• https://app.rain-alarm.com/* low Scoped to own app domain; expected API endpoint.
• https://www.rain-alarm.com/* low Scoped to own www domain; expected.

Pillar Scores

Bookkeeping