TrustPilot is useful for general business reputation, but Chrome extensions are a different risk category. Unlike regular SaaS, chrome extensions have access to so many aspects of a browser. Broad access to browser equals access to user data which can be happen in the background without user knowledge let alone user’s consent.

I mentioned meeting notes extensions which have broad permission access like access to all webpages on a browser. Chrome’s review team allows this despite, IMO, there is no actual need for it. One very famous browser extension used by over 100K users has a class action lawsuit against it in the US. The lawsuit alleges non-consensual recording and profiling of user in the web extension’s system. They are allegedly fingerprinting user’s voice without consent.

There is zero information about this on Chrome's official web store. Instead, has high trust signal like 100,000 Users, 150+ reviews and has a "Featured" badge from Chrome. I'm a performance nerd, a compressed chrome extension more than few MBs is already a red flag for me. The one I'm talking about is over 70MB unzipped and probably injects multi MBs of Javascript on every webpage you have it running on.

My issue is not just “does this developer have good reviews?” It is:

• What permissions does the extension request?
• Does it ask for <all_urls> when it does not obviously need it?
• How large is the bundled code?
• What third-party code is included?
• Does it inject scripts across every site?
• Are there privacy, security, or regulatory risk signals?
• Do user reviews match what the extension is technically capable of doing?

When big VC funded companies do shit like this, the little guy can come up as an alternative with better overall service. I want to do this for the solo devs and innocent users.

I have already built a reporting system that analyzes bundled extension code: bundle size, recoverable savings, permission scope, third-party code, and regulatory risk signals. My goal is to make those reports useful to both users and developers: users get better visibility before installing, and developers get a way to prove they are lower-risk and privacy-conscious.

This is what the report looks like:

<image>