Question 1

Will it tell me why the Chrome Web Store would reject my extension?

Accepted Answer

That is what review is for. It predicts what will likely be rejected, what triggers a slow manual review, and what would auto-disable the extension for existing users on update. Every finding names the Chrome Web Store program policy it predicts against, so you can read the rule at the source and quote it if a reviewer disagrees.

Question 2

Does my code get uploaded anywhere?

Accepted Answer

Your build never leaves your machine with review: it reads the manifest and listing text inside the package locally, and needs no API key. Two things do go out, neither of them your code. Passing --extension-id fetches your last published manifest from our catalog so it can diff for auto-disable risk — that sends the extension id, not your build. And the CLI reports anonymous usage (command and flag names, versions, a coarse error kind — never file paths, artifact contents or manifest data), which you can turn off with DO_NOT_TRACK=1 or EXTENSHI_TELEMETRY=0. scan is the one command that does upload the packaged artifact, because the eight-scanner engine runs server-side.

Question 3

Do I need an account or an API key?

Accepted Answer

Not for review — it works with no account at all. scan needs an API key, which you get by running extenshi login once. Every account includes a one-time free allowance of 3 scans and 10 reads, with no card required.

Question 4

Does it check Manifest V3 compliance?

Accepted Answer

Yes. The review rules read your manifest directly, so Manifest V3 problems — permissions you declare but never use, broad host access like <all_urls>, and permission additions that would auto-disable your extension for existing users — are flagged before you submit rather than after a reviewer finds them.

Question 5

Which stores does it cover?

Accepted Answer

Chrome Web Store, Firefox Add-ons, and Edge Add-ons. Permission sets differ per store, so review takes --store chrome|firefox|edge and diffs the manifest against the right one; the scan report splits store-compliance findings into the Chrome/Edge and Firefox sections you actually publish to.

Question 6

Does it check my store listing too, or only the code?

Accepted Answer

Both. Moderation reads your listing as closely as your code, so the listing rules run on every invocation using the name and short description from the package — including each locale you ship. The full description only exists in the developer dashboard, so pass it with --listing to have the keyword-spam rules read that as well.

Question 7

Can I run it in CI and fail the build on findings?

Accepted Answer

Yes. Run it with --json in GitHub Actions and gate on the severity counts you care about. Note that the exit code signals whether the scan ran, not whether it found anything — a scan that completes with critical findings still exits 0, so read the JSON and decide the threshold yourself. A pre-flight probe detects short CI outbound timeouts before the real scan starts.

Question 8

What does it cost?

Accepted Answer

review is always free. Scanning draws on a one-time free allowance of 3 scans, and scanning an extension whose ownership you have verified is free as well. Beyond that you buy prepaid scan packs — no subscription, and the credits never expire. A scan that dies mid-stream is refunded automatically within a minute.

Your next release. One step ahead.

The whole pre-flight, before the store sees it

A report you can actually read

A catalog-style safety score

Eight scanners on every build

Gate every release on a clean scan

`--json` for machine output

CI-timeout preflight built in

Auto-refund on failure

Free to start

Chrome Web Store questions, answered

More developer tools

MCP server

Manifest generator

Pin guide

Uninstall feedback

Policy generator

Icon generator

The reviewer takes a week. The scanner takes two minutes.