Image Resizer Extension

The bundled manifest declares `sidePanel` permission and `host_permissions` to `hqcklghtagnlihrccyqo.supabase.co` (the publisher's analytics/entitlement backend), but the published CWS listing manifest shows only `storage` with no `sidePanel` and no `host_permissions`. This is a direct manifest mismatch: users installing the extension from the Store see a permission summary that omits two functional capabilities actually present in the installed bundle. Under-disclosing permissions in the store listing — whether from negligence or intent — violates CWS policy and prevents informed user consent.

{  "manifest_version": 3,  "name": "Image Resizer Extension",  "version": "5.3",  "permissions": [    "storage",    "sidePanel"  ],  "host_permissions": [    "https://hqcklghtagnlihrccyqo.supabase.co/*"  ],  "side_panel": {    "default_path": "sidepanel.html"  },  ...

The `APP_NAME` constant is hardcoded as `"expressfit"` rather than anything related to this Image Resizer Extension, and all analytics events (paywall views, checkout starts, restore attempts — including the user-entered email at checkout time) are logged to the publisher's Supabase backend under that foreign product name. This indicates the monetization script is a shared template copy-pasted across multiple extensions without modification, which is a hallmark of factory-style extension publishing operations. While the Supabase destination is first-party and the email is voluntarily entered, the cross-extension identity bleed means the publisher is aggregating behavioral data across a fleet of extensions in a single backend, and CWS declares no data collection for any of this.

(function() {  const APP_NAME = "expressfit";  const SUPABASE_FUNCTIONS_BASE =    "https://hqcklghtagnlihrccyqo.supabase.co/functions/v1";  const TRACK_MONETIZATION_URL =    SUPABASE_FUNCTIONS_BASE + "/track-monetization-event";  ...  function trackMonetizationEvent(eventName, metadata) {    ...    const payload = {      app: APP_NAME, // "expressfit" — not "Image Resizer Extension"      platform: PLATFORM,      timestamp: new Date().toISOString(),      event: eventName,    };    if (metadata) payload.metadata = metadata;    fetch(TRACK_MONETIZATION_URL, {      method: "POST",      ...body: JSON.stringify(payload)    })  }  globalThis.trackMonetizationEvent = trackMonetizationEvent;})();