ExtensionShield is a Chrome extension security scanner and governance workflow. The public repo runs locally in OSS mode with SQLite by default, and the scanner, CLI, and report UI do not require Supabase or a cloud account.
It can scan extensions from the Chrome Web Store or from local CRX/ZIP files. Each scan can include manifest/permission review, Semgrep SAST findings, entropy/obfuscation checks, optional VirusTotal signals, and a scored report across Security, Privacy, and Governance.
|
Install the ExtensionShield Chrome extension to review installed extensions and open ExtensionShield scan reports from the browser.
|
|
ExtensionShield scans browser extensions and produces evidence-linked reports for security, privacy, and governance review.
The local OSS flow is SQLite-first. Optional hosted features such as auth, user history, telemetry dashboards, and community review queue are part of ExtensionShield Cloud.
| Area | What is implemented | Repo evidence |
|---|---|---|
| Local run | make api, make frontend, make analyze, and make analyze-file default to SQLite (ExtensionShield.db) |
Makefile |
| Inputs | Chrome Web Store URL scans and local CRX/ZIP uploads | src/extension_shield/api/main.py, src/extension_shield/utils/extension.py |
| Analysis | Permissions, SAST, entropy/obfuscation, web store metadata, network/privacy signals, and optional VirusTotal data | src/extension_shield/governance/signal_pack.py, src/extension_shield/config/custom_semgrep_rules.yaml |
| Scoring | 0-100 Security, Privacy, and Governance layer scores with hard gates for high-confidence threats | src/extension_shield/scoring/engine.py, src/extension_shield/scoring/gates.py |
| Reports | Frontend report views for scan results, evidence, summaries, and layer details | frontend/src/pages/scanner/ScanResultsPageV2.jsx, frontend/src/components/report/ |
| Open-core boundary | OSS mode runs scanner, CLI, SQLite, and report UI without cloud calls; cloud-only routes are gated | docs/OPEN_CORE_BOUNDARIES.md |
In OSS mode, you get the scanner, CLI, local SQLite storage, and report UI. In Cloud mode, hosted ExtensionShield adds auth, user history, telemetry/admin features, and community/enterprise workflows.
| Document | Description |
|---|---|
| GET_STARTED.md | Setup, config, Docker, CLI, OSS vs Cloud, and Make commands |
| scripts/README.md | What each script does and when to run it |
| OPEN_CORE_BOUNDARIES.md | OSS vs Cloud, enforcement, and configuration |
| CONTRIBUTING.md | How to contribute |
| SECURITY.md | Reporting vulnerabilities and secrets policy |
| COMMERCIAL.md | Commercial use guidance |
| TRADEMARK.md | Brand usage guidelines |
| CODE_OF_CONDUCT.md | Community standards |
| NOTICE | Third-party attributions |
- Core (scanner, CLI, local analysis): MIT — see LICENSE. The core is derived from ThreatXtension (MIT as declared in its README — see NOTICE for the license basis).
- Cloud (auth, Supabase, telemetry admin, community queue, enterprise forms): proprietary, available via ExtensionShield Cloud
Acknowledgments & attribution: ExtensionShield began as a derivative of ThreatXtension, whose README states MIT licensing. ExtensionShield retains derived scanner components and adds original work including the V2 scoring engine, governance layer, browser extension, cloud features, and redesigned frontend. See NOTICE for attribution and file-level provenance.
We build ExtensionShield in the open so security tools stay transparent and easy to inspect.
Feedback, issue reports, docs fixes, tests, and rule improvements are welcome. If ExtensionShield helps you, consider opening a PR, sharing your use case, or supporting the project.