Top Risks

• Privacy policy is Google's generic account policy — not scoped to this extension; admits data collection and 3rd-party sharing.
• Developer uses free Gmail address with no business domain; GitLab brand mentioned without confirmed ownership (impersonation flag).
• No CSP declared (MV3 mitigates somewhat but inline execution remains unguarded).
• 23 installs with gmail dev identity and brand impersonation flag creates reputational uncertainty.
• Wayback fetch error means ownership-transfer history cannot be confirmed.

Evidence

• brand_impersonation store brand_mention.is_impersonation=true; brands_mentioned=['gitlab']; confirmed_owner=false; dev domain=gmail.com
• privacy_policy_generic store Policy URL is Google account privacy page; scope_extension=false, data_collection=true, third_party_sharing=true → +10.0
• free_webmail_dev manifest developer_email=abhinavcext@gmail.com; no business domain or verified publisher badge.
• no_csp manifest content_security_policy=null; MV3 mitigates remote code loading but no explicit CSP defined.
• clean_code_scan crx code_findings_raw=[]; obfuscation_score=0.0; 3 JS files scanned; no exfil or eval signals.
• host_scope_narrow manifest host_permissions=['https://gitlab.com/*']; content_scripts scoped to /*/merge_requests/*; well-scoped.
• no_threat_intel_hits api bad_host_hits=[], affiliate_hits=[], monetization_hits=[]; js_external_hosts=['docs.gitlab.com','gitlab.com'] only.
• recently_updated store months_since_update=1; maintenance risk=0.

Permissions Breakdown

• storage low Local key-value storage; no cross-origin data access risk.
• host: https://gitlab.com/* medium Scoped to gitlab.com only; content script limited to merge_request paths.

Pillar Scores

Bookkeeping