All network traffic from this extension flows exclusively to publisher-owned domains ([domain withheld] and [domain withheld]) via lines 315-327 and 483-492; no third-party data exfiltration exists. Cookie access is narrowly scoped — lines 130-146 only read the `civra_session` cookie from [domain withheld] for authentication, not credential theft from arbitrary sites. The extension's behavior (injecting risk badges into Gmail, sending email metadata to a backend for analysis, scanning links and attachments) precisely matches its CWS description and privacy disclosures (Personal communications, Website content, Authentication information, PII are all disclosed). The bundled manifest includes `[domain withheld] as a host_permission that does not appear in the published manifest summary — a minor discrepancy worth noting, though [domain withheld] is a subdomain of the publisher's primary domain and the content script on that domain () merely syncs theme settings.