Fast Invite BM Chrome extension security report

Fast Invite BM is a minimal, single-purpose Chrome extension for sending Facebook Business Manager invitations one email at a time. No bulk lists, no automation, no background activity — open the popup, fill three fields, click once. ═══════════════════════════════════════════════ WHO IS THIS FOR ═══════════════════════════════════════════════ You manage one or more Facebook Business Managers and need to add a teammate, freelancer, or test account quickly. Doing it through Facebook's own UI takes 6+ clicks across 3 nested menus. This extension does the same thing in one popup, in under 5 seconds. ═══════════════════════════════════════════════ KEY FEATURES ═══════════════════════════════════════════════ • AUTO-DETECTS BM ID — Open the popup while you're on a Facebook Business page, the BM ID fills in automatically. • ROLE PICKER — Choose Admin (full BM access) or Employee (limited access) from a clear dropdown. • RANDOM EMAIL GENERATOR — One click generates a temporary 282mail.com address for testing, scoped to the current BM ID for easy inbox tracking. • OPEN INBOX — One click opens 282mail.com in a new tab so you can read the invitation. The extension itself never reads your email. • FALLBACK API — If Facebook's primary endpoint hiccups, the extension automatically tries a secondary endpoint. You don't have to retry manually. • AUTO TOKEN REFRESH — When your Facebook session changes, the extension fetches a fresh token transparently. No "please log in again" loops. • SMART PASTE — Paste a full Facebook Business URL into the BM ID field, the ID gets extracted automatically. ═══════════════════════════════════════════════ HOW TO USE ═══════════════════════════════════════════════ 1. Make sure you're logged in to Facebook in the same browser profile. 2. Open a Business Manager tab (e.g. business.facebook.com) — the BM ID auto-fills. 3. Type an email or click the dice (Random) button to generate one. 4. Pick the role: Admin or Employee. 5. Click "Send Invite". 6. On success, click "Open inbox" to read the invitation on 282mail.com. ═══════════════════════════════════════════════ PRIVACY ═══════════════════════════════════════════════ This extension does only ONE thing — send a BM invite to Facebook on your behalf. It does not: • Collect analytics • Send data to third-party servers • Store your password (it never asks for one) • Persist any form data — every popup open starts with empty fields • Read your email • Run in the background • Send notifications Your Facebook session token is read from your existing browser cookies, cached for 15 minutes in volatile session storage (cleared every time you restart your browser), and used only to make the invite call to Facebook's API. The "Open inbox" button is a plain hyperlink — clicking it navigates your browser to 282mail.com, but the extension itself never makes a request to that domain. Full privacy policy at the support URL listed below. ═══════════════════════════════════════════════ PERMISSIONS — WHY EACH IS NEEDED ═══════════════════════════════════════════════ • storage — to cache your Facebook session token in volatile session storage (cleared on browser restart, never written to disk). • activeTab — to read the URL of your current tab when you click the extension button, so the BM ID auto-fills. • scripting — to read the active BM ID directly from the Facebook Business page context (BusinessUnifiedNavigationContext.businessID) so you don't have to copy and paste. • declarativeNetRequestWithHostAccess — to set the Origin header on extension-to-Facebook requests so Facebook attaches your session cookie. Without this, Facebook would reject the invite call. • host_permissions for facebook.com — to send the invite request to Facebook's API. Facebook is the ONLY server this extension contacts. ═══════════════════════════════════════════════ WHAT THIS EXTENSION DOES NOT DO ═══════════════════════════════════════════════ • Bulk invite from a list — single invite per click only • Automation, scheduling, or scraping • Read your Facebook messages, friends, ads, or any other data • Modify any Facebook content • Run when you're not actively using the popup • Show ads or promotions ═══════════════════════════════════════════════ TROUBLESHOOTING ═══════════════════════════════════════════════ "Cannot read Facebook session" — You're not logged in to Facebook in this browser. Open business.facebook.com, log in, and try again. "BM ID didn't auto-fill" — The active tab isn't a Facebook Business page, or the page is still loading. Paste the BM ID manually or wait for the page to finish loading. "Invite failed" — Facebook returned an error. The detailed error is in the "Show technical details" panel. Common causes: BM has reached its user limit, the email is already invited, or the BM ID is wrong. ═══════════════════════════════════════════════ SOURCE CODE ═══════════════════════════════════════════════ This extension is open source. Every line of code is auditable at the homepage URL above. No obfuscation, no minification, no remote code execution.