Example report

Synthetic extension preflight report - ExtensionGate

See how ExtensionGate presents blockers, review items, evidence, limits, and a submission-packet preview without exposing customer data.

Human-reviewed 2026-07-29

Synthetic demo throughout · no customer package or real findings

Target: Chrome and Edge
Overall result: Static blockers found
Coverage: Complete
Ruleset: chrome-edge-2026.07.29.2

BlockerCertain

EG-RHC-001: Remote script is loaded

Synthetic evidence:popup.html:18 references executable JavaScript outside the submitted package.

<script src="https://cdn.example.test/widget.js"></script>

Bundle the dependency inside the extension and reference a relative package path. Do not replace it with fetched code and an executable sink.

Rule details and official source

Needs reviewContext required

EG-PERM-004: Broad host access

Synthetic evidence:manifest.json:11 requests <all_urls>.

Document the user-visible feature, trigger, accessed data, and why activeTab, optional access, or narrower hosts cannot meet the need.

Rule details and boundaries

Action requiredCertain flow

EG-DATA-008: Disclosure mismatch

Synthetic code evidence: a page URL can be posted to api.example.test. The synthetic questionnaire says URLs never leave the device.

Confirm reachability, then stop the transmission or reconcile consent, disclosure, privacy copy, retention, and store answers.

Rule details and limits

Edge actionCertain manifest fact

EG-MAN-018: Chrome update URL remains

Synthetic evidence:manifest.json:6 declares a Chrome Web Store update_url in an Edge-targeted ZIP.

"update_url": "https://clients2.google.com/service/update2/crx"

Remove the key from the Edge Add-ons build, then sideload and test that exact ZIP. This finding is scoped to the Add-ons submission, not every enterprise or self-hosted Edge scenario.

Rule details and official source

Submission packet preview

Reviewer-ready evidence

Target-specific manifest checklist
Permission-purpose justification table
Data-flow and disclosure reconciliation
Certification notes and change log

The 30-day Release Pass exports these materials.

Scan before checkout

Report limits

This example demonstrates presentation, not detection coverage. A real report is static evidence only: it cannot prove runtime behavior, backend practices, legal compliance, or store approval.

Run your private local scan How it works