Question 1

What is Extension Auditor?

Accepted Answer

Extension Auditor is a browser extension security platform that helps organizations analyze, monitor, and manage browser extensions across their workforce. We provide: Risk analysis of extension permissions, manifests, publisher identity and code for Chrome Web Store, Microsoft Edge Add-ons and Firefox Add-ons extensions Fleet inventory from a lightweight companion agent or from Google Workspace / Microsoft Entra Continuous monitoring for changes to the extensions you approve Policy enforcement — allow, warn or block extensions on managed browsers Automated alerts when an extension becomes risky

Question 2

Is the browser extension alone sufficient, or do I need the web platform?

Accepted Answer

It depends on your use case: On-device analyzer only: Analyze individual extensions on demand Free, runs on-device, no account required Web platform: Continuous monitoring and automated alerts for the extensions you choose Fleet inventory from the companion agent or Google Workspace / Microsoft Entra Policy enforcement (allow / warn / block) across managed browsers Team workspaces, API access and webhook integrations The web platform has a permanent Free plan (1 managed browser, 5 monitored extensions) — you do not need a paid plan to start monitoring. Paid plans add fleet scale, ad-hoc lookups and, from Business up, admin-console sync.

Question 3

How do I get started?

Accepted Answer

Getting started takes under 10 minutes: Create a free account at extensionauditor.com — the onboarding wizard walks you through the rest Enroll the companion browser agent on the browsers you want to protect, or push it to your fleet with your MDM Connect Google Workspace or Microsoft Entra (Business and up) to sync your organization's extensions with nothing to install on individual devices Configure alerts in Slack, Teams, email or via webhook Want to check a single extension first? Paste its ID or store URL into the scan page — no account needed — or install the on-device analyzer from the Chrome Web Store.

Question 4

How do we deploy the companion agent across our fleet?

Accepted Answer

You have two paths, and you can mix them: Agent-based (the companion browser agent): Install the companion extension on each browser profile you want to protect — Chrome, Edge or Brave Push it silently at scale with your MDM / management tooling — Chrome or Edge force-install policy (Google Admin, Microsoft Intune, group policy, or any MDM that sets extension policies). Managed configuration binds the device to your organization with no user login Each enrolled browser profile counts as one managed browser for billing Policy verdicts (allow / warn / block) are enforced on the browser itself Agent-less (admin-console sync, Business and up): Connect Google Workspace or Microsoft Entra and we read your organization's installed extensions from your admin console — nothing to install on individual devices Most teams start agent-less for instant inventory, then add the agent where they want per-browser policy enforcement.

Question 5

Does the companion agent slow down the browser?

Accepted Answer

No meaningful impact. The companion agent is intentionally lightweight: It reads the list of installed extensions and reports inventory — it does not intercept web traffic, inject content scripts into your pages, or read browsing data Reporting happens periodically in the background, not on every page load Policy enforcement (disabling a blocked extension, showing a warning) only runs when a violation is found Permissions it requests at install: management (enumerate and disable extensions), tabs and notifications (show a warning or block notice), declarativeNetRequest (block policy-listed domains without any host access), plus storage and alarms for scheduling. On-page inspection is an optional permission that admins can grant separately; it is off by default. There is no measurable effect on page rendering or browsing performance for end users.

Question 6

What changes do you monitor?

Accepted Answer

We track 11 distinct event types : Permission changes — new capabilities requested Host permission changes — expanded website access Ownership/publisher changes — potential supply chain risk Account type changes — publisher verification status Version updates — new code deployed Visibility changes — public, unlisted, or removed Manifest changes — configuration modifications Content Security Policy changes — security boundary updates Review changes — user feedback trends Rating changes — reputation signals Security verdict changes — flagged by stores or security vendors

Question 7

How fast are alerts when an extension changes?

Accepted Answer

Monitoring runs on a schedule rather than real-time streaming: Monitored extensions — change detection runs every hour Store-wide catalog refresh (Chrome Web Store and Edge Add-ons) — daily , with store statistics refreshed hourly Newly published versions — queued for full risk analysis within a few hours of being ingested When a change is detected, alerts go out immediately to every channel you configured (in-app, email, Slack, Teams or webhook).

Question 8

What alert channels do you support?

Accepted Answer

Every plan, including Free, can send alerts to every channel: In-app notifications — always on Email — change summaries and digests Slack — formatted message blocks with links back to the extension Microsoft Teams — MessageCard format with rich previews Custom webhooks — full JSON payload for SIEM or automation Business and Enterprise plans add reusable notification destinations , so one Slack channel or webhook can be attached to many monitors instead of being configured per monitor. Webhook payloads identify the extension, the event type, the old and new values, a timestamp and a direct link to the extension in our platform.

Question 9

Can I integrate with my SIEM?

Accepted Answer

Yes. Custom webhooks are available on every plan and deliver structured JSON that can be ingested by: Splunk Elastic / ELK Stack Microsoft Sentinel Any log aggregation system that accepts JSON payloads The payload follows a consistent schema across all 11 event types, so you can build dashboards and correlation rules once. Business and Enterprise plans let you define a webhook destination once and reuse it across monitors. If you prefer pull over push, the REST API exposes the same change history.

Question 10

Which browsers does the extension support?

Accepted Answer

There are two extensions, and they cover different browsers: On-device analyzer (the consumer extension) works on all Chromium-based browsers : Google Chrome Microsoft Edge Brave Opera Arc Vivaldi Companion agent (the fleet sensor for organizations) runs on Chrome, Microsoft Edge and Brave , with a Firefox build available for teams that need it. Every enrolled browser profile counts as one managed browser, whatever the brand. Browser brand never changes your plan: Chrome, Edge and Firefox fleets are covered on every plan, including Free, because you pay per managed browser rather than per browser type.

Question 11

Which extension stores do you monitor?

Accepted Answer

We cover the three major stores: Chrome Web Store — full catalog, refreshed daily, with hourly change detection on the extensions you monitor Microsoft Edge Add-ons — same analysis and monitoring; search for Edge extensions directly from the scan page Firefox Add-ons — the AMO catalog is ingested and every add-on has a public analysis page with its permissions, manifest and security report. Paste an addons.mozilla.org URL into the scan page or filter search by Firefox Extensions that a publisher lists on more than one store are tracked separately per store, so an Edge-only permission change is caught even if the Chrome listing is unchanged. Firefox listings are refreshed on the ingestion schedule rather than re-scraped on demand, so store-side change alerts for Firefox add-ons lag the Chrome and Edge stores. If that gap matters for your deployment, contact us .

Question 12

I only use Microsoft Edge. Can you still help?

Accepted Answer

Yes. Edge is a first-class platform: Edge Add-ons store monitoring — extensions published on Microsoft Edge Add-ons are analyzed and monitored exactly like Chrome Web Store extensions, including Edge-exclusive listings Companion agent on Edge — the fleet sensor installs on Edge and reports the extensions on each profile; push it with Intune, group policy or any MDM that sets Edge extension policies On-device analyzer — our consumer extension is Chromium-compatible and runs in Edge Many extensions are published on both stores. We track each store listing separately, so a change that only lands in the Edge listing still triggers an alert.

Question 13

Which identity providers do you support?

Accepted Answer

Google Workspace — via Chrome Browser Cloud Management Microsoft Entra — via Microsoft Entra / Defender These integrations automatically sync your organization's managed browsers and their installed extensions into Extension Auditor — an agent-less alternative to enrolling the companion browser agent on each device. They are available on the Business and Enterprise plans. For sign-in, every plan supports MFA and OAuth with Google, GitHub, Apple and Microsoft.

Question 14

How does Google Workspace integration work?

Accepted Answer

Once connected, we pull the list of browser extensions installed across your organization's managed browsers — nothing to install on individual devices. How it works: Connect your Google Workspace with a service account that has read access to Chrome Browser Cloud Management We read enrolled browsers, profiles and their installed extensions from the admin console Discovered extensions are analyzed and surfaced under Discover in your workspace Syncs run on a schedule (daily by default) and can be triggered on demand Microsoft Entra / Defender works the same way for Edge-managed fleets. Admin-console sync is available on the Business and Enterprise plans; the companion agent covers the same inventory on every plan.

Question 15

What's included in the free tier?

Accepted Answer

The Free plan is a real, unmetered slice of the product — not a demo: 1 managed browser (Chrome, Edge or Firefox) 5 monitored extensions discovered on that browser, analyzed and monitored for all 11 change types Full risk analysis — permissions, manifest, publisher identity and code-pattern findings All alert channels — in-app, email, Slack, Microsoft Teams and custom webhooks API access with a 100-calls-per-month quota Audit logging No credit card is required. Ad-hoc lookups of extensions outside your browser are not included on Free, and Google Workspace / Microsoft Entra fleet sync starts on the Business plan. See pricing for the full comparison.

Question 16

What requires a paid plan?

Accepted Answer

Some capabilities ship on every plan, including Free — risk analysis and alerting are not tiered: All 11 monitor event types Full risk analysis — permissions, manifest and publisher identity In-app, email, Slack, Microsoft Teams and custom webhook alerts Full API access with detailed documentation Chrome, Edge and Firefox browser fleets Agent-based deployment via the companion browser agent Account activity log Paid plans add fleet scale and the surrounding service: More managed browsers — Free covers 1; Personal covers 3, Family 10, and the organization plans scale with your fleet Included ad-hoc lookups for extensions outside your fleet Google Workspace and Microsoft Entra fleet sync (Business and up) Reusable notification destinations and security questionnaire support (SIG/CAIQ-style) (Business and up) Dedicated Customer Success Manager and priority support (Business and up) SLA-backed uptime and self-hosted deployment (Enterprise) Consumer plans are flat-priced: Personal ($9/month or $108/year) and Family ($15/month or $149/year). Organization plans are billed per managed browser , monthly or annually: Team ($9/browser/month, 5-browser minimum), Business ($12/browser/month, 25-browser minimum) and Enterprise (from $18/browser/month, 1,001+ browsers, annual contract). Dashboard logins are always free — you only pay for the browsers you protect.

Question 17

Do you offer a free trial?

Accepted Answer

Yes. Every self-serve plan — Personal , Family , Team and Business — includes a 7-day free trial . You enter card details when you start the trial, but you are not charged until it ends, and you can cancel any time before then. There is also a permanent Free plan with 1 managed browser and 5 monitored extensions, so you can evaluate the product without a trial at all. Enterprise is scoped per contract rather than self-serve. For Enterprise evaluations or a proof of concept, talk to sales .

Question 18

Do you have an API?

Accepted Answer

Yes. The REST API lets you: Query extension metadata, permissions, versions and risk scores Retrieve your monitored extension inventory and fleet data Read change history and detect permission drift Manage monitors and notification destinations programmatically API access and full documentation ship on every plan, including Free . Plans differ only in monthly call quota (from 100 calls on Free to unlimited on Enterprise) and burst rate limits. API usage and platform usage draw from the same allowances, so an extension lookup counts the same either way. Generate an API key from your account settings; interactive docs live at /api/docs/scalar .

Question 19

Is my data secure?

Accepted Answer

Yes. Security is built into every layer, and our Security page describes what is in place today versus what is on the roadmap. Browser extensions: The on-device analyzer runs locally and only talks to extensionauditor.com The companion agent reads the list of installed extensions — it does not intercept web traffic, inject scripts into your pages or read browsing data Both request a small, purpose-specific permission set (see the companion agent FAQ for the exact list) Web platform: TLS 1.3 with HSTS on every endpoint, with a web application firewall and DDoS mitigation at the edge Tenant isolation enforced with Postgres row-level security on every table MFA on every plan, including Free — login security is never an upsell One-time-password confirmation on destructive account actions — ownership transfer and account deletion Payments handled by Stripe (PCI Level 1); card numbers never touch our servers Compliance: GDPR and Singapore PDPA programs are maintained, with a Data Protection Officer at dpo@extensionauditor.com and a DPA available on request. We do not currently hold SOC 2 or ISO 27001 certification; current security documentation is available to prospective customers on request.

Question 20

How do you calculate risk scores?

Accepted Answer

Our risk analysis evaluates multiple factors: Permission sensitivity — dangerous vs. benign capabilities Host access breadth — all sites vs. specific domains Content script behavior — page modification scope Manifest configuration — CSP, web accessible resources Publisher trust signals — verification, history, reputation Historical patterns — permission creep over time Findings are classified as Critical , High , Medium , or Low based on potential for misuse.

Question 21

Is your analysis based on real research?

Accepted Answer

Yes. Extension Auditor's risk models are built on published, peer-reviewed security research covering: Browser extension threat models Permission abuse patterns Supply chain attack vectors Malicious extension detection techniques Our methodology is continuously updated as new research is published and new attack patterns emerge.

Question 22

Can I use Extension Auditor for compliance (SOC2, GDPR)?

Accepted Answer

Yes — as evidence for your own program, not as a certification of ours. Extension governance is a control your auditors ask about, and the platform produces the evidence: Continuous monitoring — every plan tracks all 11 change types across your monitored extensions Audit logging — every plan records who changed what and when Policy enforcement — allow / warn / block verdicts applied by the companion agent, so approved-extension lists are enforced rather than just documented Security questionnaire support (SIG/CAIQ-style) (Business and Enterprise) — help answering the extension-governance sections of vendor security questionnaires, with exportable monitoring evidence for your own audit file Change history and inventory are available over the API and via webhooks, so you can pull evidence into your own GRC tooling. Our own posture (GDPR and PDPA programs maintained) is described on the Security page ; we do not currently hold SOC 2 or ISO 27001 certification.

Question 23

Do you support team workspaces?

Accepted Answer

Yes. Every account is a workspace with: Role-based access control — Owner and Member roles Shared extension inventory — single source of truth for the fleet Team-wide alerts — everyone on the account sees the same notifications Audit logging — see who changed what and when Member limits follow the plan: Personal is a single login, Family allows up to 5 people, and the organization plans ( Team , Business , Enterprise ) have no member limit. On organization plans dashboard logins are free — billing is per managed browser, not per seat.

Question 24

Can I export data for reporting?

Accepted Answer

Yes. Your data is available outside the dashboard in two ways, on every plan: REST API — pull extension inventories, risk assessments, versions and change history as JSON, at whatever cadence your reporting needs Webhooks — push every monitored change into your SIEM, ticketing system or data warehouse as it happens Public extension analysis pages under /scan can also be shared directly with stakeholders who do not have a login.

Question 25

I'm a publisher — how do I request removal or correction of my extension's data?

Accepted Answer

Extension Auditor analyzes publicly available store data (permissions, manifests, publisher identity, published code) from the Chrome Web Store, Microsoft Edge Add-ons and Firefox Add-ons to help organizations assess extension risk. We don't collect private data about your extension. If you're the publisher and want to request a correction, or ask us to remove your extension's public analysis page, contact us from your publisher email and include the extension's store ID. We review publisher requests individually and typically respond within a few business days.

Question 26

Do I pay per user, per browser, or per extension?

Accepted Answer

Per user on Team and Business — you buy licences, not browsers and not extensions. Personal is a flat $9/month for one account. Your allowances still scale with your fleet: each managed browser covers 5 discovered extensions, analyzed and monitored, where a "managed browser" is one browser profile running the companion sensor (or one surfaced via Google Workspace / Microsoft Entra sync). Admin logins to the dashboard are unlimited and never billed.

Question 27

How does per-user billing work?

Accepted Answer

You choose a licence count at checkout and that is what you pay for until you change it — a member leaving never silently drops the quantity below what was purchased. Team is $12/user/month (or $144/user/year, billed annually) from a 10-user minimum; Business is $15/user/month (or $180/user/year) from a 100-user minimum and adds Workspace / Entra fleet sync, compliance reports, reusable destinations and a dedicated CSM; Enterprise is scoped per contract. Add or remove licences anytime; your next invoice prorates the change. Enrolling browsers costs nothing extra — the licence count is what you are billed on.

Question 28

Why are there user minimums?

Accepted Answer

Each customer has fixed onboarding and support costs regardless of size. Licence floors keep pricing fair — small teams pay the floor; larger teams scale linearly. Team starts at 10 users, Business at 100, and Enterprise is scoped per contract. Browser counts are guidance, not a forced upgrade — you pick Business for Workspace / Entra sync and compliance reporting, not because you crossed a browser count.

Question 29

Is there a limit on how many extensions I can monitor?

Accepted Answer

Your allowance scales with your fleet: every managed browser covers 5 discovered extensions, analyzed and monitored. A 180-browser plan therefore covers 900 discovered extensions. The rate is the same on Team, Business, and Enterprise — you add capacity by enrolling more browsers, not by upgrading tiers.

Question 30

What is an extension lookup, and when am I charged for one?

Accepted Answer

A lookup is analyzing an extension that is NOT installed on one of your managed browsers — an ad-hoc check of something you are evaluating. Extensions discovered on your own fleet are never lookups and never cost extra. Each managed browser includes 1 lookup, so 180 browsers means 180 included lookups. Beyond that, additional lookups are $6 each. Lookups draw from the same allowance whether you make them in the platform or over the API.

Question 31

Do I need a paid plan to use the API?

Accepted Answer

No — full API access and documentation are available on every plan, including Free. API usage and platform usage draw from the same allowances, so an extension lookup counts the same either way.

Question 32

What's the difference between quotas and rate limits?

Accepted Answer

Quotas are slow-changing monthly ceilings — things like "extensions monitored" and "deep AI reviews per month." They reset on the first of each calendar month and represent resources you can build against. Rate limits are short-window burst protection (15-minute sliding window) — things like "API requests per window." They prevent abuse and keep the service fast for everyone. If you hit a rate limit, you'll see a 429 response; once the window slides forward, requests resume normally.

Question 33

Do you support browsers other than Chrome?

Accepted Answer

Yes. Every paid plan includes Chrome, Edge, and Firefox monitoring — since you pay per managed browser, all browser brands are covered on the same plan. Android extensions are not on the roadmap.

Question 34

Can I cancel anytime?

Accepted Answer

Yes. Monthly plans cancel at the end of the current period. Annual plans can cancel anytime; refunds are prorated for unused months minus a small administrative fee.

Question 35

Do you offer a discount for non-profits or open-source security teams?

Accepted Answer

Yes — contact sales. We offer 50% off Team and Business for verified non-profits and approved open-source security efforts.

Question 36

What payment methods do you accept?

Accepted Answer

All major credit cards via Stripe. Annual Enterprise contracts can be paid by invoice (NET 30) on request.

We've got answers