ProScreen S3: Self-Cloud Capture & Record

The bundled manifest requests storage, downloads, and file://*/* permissions, none of which appear in the published CWS manifest summary (which only lists http://*/*, https://*/*, desktopCapture, activeTab). This discrepancy means the extension runs with meaningfully broader capabilities than what Google surfaces to users during installation review, and users cannot see the full permission footprint from the store listing.

{  "permissions": [    "storage",    "downloads",    "http://*/*",    "https://*/*",    "activeTab",    "file://*/*",    "desktopCapture"  ]}

When the user clicks 'Share', the captured screenshot together with the full source page URL (image_from) and page title are uploaded to https://snapshot.ngocquy.net/api/v1/images — the publisher's own hosting service. The extension markets itself as 'upload to your own S3 storage / privacy-first', but there is no S3 configuration flow and no user-controlled storage; all data is sent to the publisher's server. While user-initiated, this contradicts the stated privacy promise and means the publisher receives every screenshot a user chooses to share along with the URL of the page that was captured.

const form = new FormData();form.append("image_snapshot", file);form.append("image_from", `${this.from}`);form.append("image_from_title", `${this.title}`);const data = await axios.post(  "https://snapshot.ngocquy.net/api/v1/images",  form);