The extension’s code implements exactly the described follower-tracking functionality. All network requests are directed at Instagram (to fetch follower data) or the publisher’s own domain (for license activation), both within declared host permissions. No credentials, personal data, or page content are exfiltrated to third parties. License activation is user‑initiated and matches the extension’s monetization model. The use of scripting permission and innerHTML is confined to building the Instagram‑page modal, using only locally‑retrieved data. No obfuscation, dynamic code loading, or other malicious indicators were found.