Top Risks

• Privacy policy is Google's generic policy (scope_extension=false, data_collection=true, third_party_sharing=true) — admits data sharing without scoping to this extension.
• Developer email on pm.me (ProtonMail); threat_intel flags domain looks_throwaway=true for pm.me.
• Host permission to posthog.com enables analytics telemetry; user activity data may be sent to third-party.
• External JS hosts include yandex.com and sentry.io alongside posthog.com — 3 distinct analytics/tracking endpoints.
• Individual developer with no verified publisher badge; no business domain identity.

Evidence

• privacy_policy_generic store Policy URL is Google's generic privacy page; scope_extension=false, data_collection=true, third_party_sharing=true → +10.0 privacy.
• posthog_host_permission manifest host_permissions includes https://*.posthog.com/* — explicit telemetry endpoint declared.
• js_external_hosts crx External hosts: app.posthog.com, react.dev, sentry.io, yandex.com — 4 domains, all single-country US.
• looks_throwaway_domain api threat_intel flags developer domain pm.me as looks_throwaway=true; pm.me is ProtonMail domain.
• no_verified_publisher store verified_publisher=false, is_featured_by_google=false; individual dev on free email provider.
• csp_present_mv3 manifest CSP restricts script-src to 'self'; connect-src allows posthog.com only. MV3 with CSP is low-risk.
• no_cve_findings crx cve_findings_raw empty; no vulnerable JS libraries detected.
• recently_updated store months_since_update=0; actively maintained.

Permissions Breakdown

• storage low Local data persistence for timer state; standard for productivity tools.
• notifications low Required to alert user when Pomodoro interval ends.
• alarms low Timer scheduling; expected for a Pomodoro app.
• contextMenus low Right-click menu entries; limited scope, no cross-site access.
• offscreen low Background audio/rendering; acceptable for timer sound alerts.
• host_permission: https://*.posthog.com/* medium Grants explicit access to PostHog analytics; telemetry exfil surface.

Pillar Scores

Bookkeeping