I built a free Chrome extension security scanner now Fortune 500 teams use it
1 comments
Scanned mine:
https://crxplorer.com?extensionId=babjpljmacbefcmlomjedmgmke...
It's getting a 20% safety score on CSP, saying:
> The complete absence of a Content Security Policy (CSP) is a critical security vulnerability…
But absence means that it uses the default, which is fine in my case:
https://developer.chrome.com/docs/extensions/reference/manif...
---
And 65% on permissions, (it uses "download") and it says:
> …its necessity is unclear without an overview of the extension’s specific purpose.
but its purpose is stated
https://crxplorer.com?extensionId=babjpljmacbefcmlomjedmgmke...
It's getting a 20% safety score on CSP, saying:
> The complete absence of a Content Security Policy (CSP) is a critical security vulnerability…
But absence means that it uses the default, which is fine in my case:
https://developer.chrome.com/docs/extensions/reference/manif...
---
And 65% on permissions, (it uses "download") and it says:
> …its necessity is unclear without an overview of the extension’s specific purpose.
but its purpose is stated
Paste a Chrome Web Store URL, it analyzes the extension and flags sketchy stuff. Added an LLM layer that catches things grep can't.
Made it free, mass awareness helps find more vulns. 20k+ people use it now, then random enterprise security teams started showing up. Still wrapping my head around that one.
https://crxplorer.com
Feedback welcome.