Local, non-executing analysis
ExtensionGate treats every extension ZIP as hostile input. Analysis runs in a constrained browser worker. It parses supported files as data and never installs, imports, evaluates, or runs extension code.
ZIP entries are normalized and bounded to resist traversal, duplicate ambiguity, decompression bombs, oversized files, excessive entry counts, and unbounded CPU work. Nested archives are not recursively expanded.
Archive safety limits
These are product safety limits, not Chrome or Edge submission limits. Exceeding one produces an explicit incomplete result rather than a misleading pass.
| Compressed ZIP | 25 MB |
|---|---|
| Expanded content | 100 MB |
| Archive entries | 10,000 |
| One text file | 20 MB |
| Expansion ratio | 100:1 |
| Analysis budget | 30 seconds |
| Nested archives | Identified but never recursively expanded |
Network and data boundary
The scanner does not upload packages or detected contents and does not fetch discovered endpoints. Source files, manifest values, credentials, report JSON, questionnaire answers, filenames, paths, hashes, domains, and permission lists are excluded from analytics.
Payment and licensed workflow services run as a separate, explicit data plane from the local scanner.
Dependencies and rule integrity
Builds pin supported dependencies and version the scanner engine, report schema, and public ruleset. Each public rule documents its evidence shape, false-positive boundaries, official sources, review date, and history. Release checks use synthetic fixtures; fixture coverage does not prove absence of vulnerabilities.
Known limits and residual risks
- A compromised browser, device, dependency, or served application can undermine local isolation.
- Static parsing can miss obfuscation, runtime-generated behavior, native helpers, and backend-to-backend activity.
- The scanner cannot inspect store form answers, privacy-policy accuracy, external service contracts, remote backends, or behavior that is absent from the submitted ZIP.
- Browser memory and device performance can stop a valid package before complete coverage; that state is reported as incomplete, never clean.
- A clean result is not a security audit, legal opinion, compliance certification, or approval guarantee.
Responsible disclosure
Report a suspected vulnerability to security@extensiongate.com. Delivery of this mailbox and a private intake process must be verified before launch.
Do not email extension packages, source code, credentials, API keys, secrets, or customer data. Start with a minimal description, affected URL or version, impact, and safe reproduction outline.