A useful first package review
This guide describes the candidate workflow. Check the installed release before relying on a feature. No need to execute the inspected target for static review.
1. Start with the owned demonstration
In the local candidate, open Settings > Help & getting started and choose the owned demonstration. The getting-started cards can also be replayed there. Published older releases may differ. It contains a storage declaration/use, an unused tabs declaration, an example.com host pattern and an inactive innerHTML example. These are review prompts, not proof of exploitation or real traffic.
2. Follow a finding to its source
Read the original file and surrounding code. Search for the permission or sink. A declared permission can be needed by code these rules do not recognize; a string or pattern match is not a confirmed vulnerability. Formatting changes presentation, not the original bytes.
3. Record what the evidence supports
Compare SHA-256 values only to establish matching bytes. Review a report before export: findings and source may contain confidential material. Download started and completed states are distinct. A generated starter scaffold is independent demonstration code, not a recovered clone.
4. Inspect your own authorized target
Use a supported Store link or a local CRX/ZIP that you are allowed to inspect. The demonstration does not consume an AI credit or count as a completed real-target scan. Paid AI is disabled for the demonstration.
5. Choose optional AI deliberately
Review the submission notice and redacted input. AI output needs manual review. Purchased credits never expire; each new reward expires 72 hours after grant. Retain your receipt and request reference if a provider or delivery fails; do not pay again to retry delivery.
Runtime is a separate workflow
Static source findings do not prove network requests, message flow or execution. Runtime Lab needs separately reviewed native installation and permissions, an owned/authorized target and a compatible configured browser. A fresh browser profile is not an OS sandbox.