Urgent.News

What's breaking now, across thousands of outlets.

Tech

Publish a Chrome Extension: 6 Steps and a Review Checklist

Originally published on ExtensionLaunch . To publish a Chrome extension, you need more than working code: the Chrome Web Store reviews your manifest, your permissions and your privacy answers before anyone can install it. Most first submissions that stall do so for avoidable reasons. Below are the six steps from developer account to first update, plus the checklist I'd run before pressing Submit.…

Before you can publish a Chrome extension, you need to have several essential items ready. These include a Google account (preferably a dedicated or Google Workspace account), an extension built on Manifest V3, a 128x128 PNG icon, at least one screenshot at 1280x800 or 640x400 resolution, a one-line summary, a longer description, a category, and a privacy policy URL if user data is handled. Additionally, you'll need $5 for the one-time registration fee.

The process of publishing begins with registering as a developer, which involves signing in to the Chrome Web Store Developer Dashboard, paying the $5 fee, and verifying your contact email. If you plan to publish under a brand, you must set up a group publisher and declare whether you are a trader or a non-trader.

Next, you'll need to tighten your manifest file. Reviewers check the package against the manifest.json file, and two critical fields are the version and permissions. Broad permissions are the most common reason for first submissions to stall. To avoid this, only request the permissions your code actually calls, scope host permissions to specific domains instead of using "all_urls", and use activeTab when page access is only needed after the user clicks. A lean MV3 manifest example is provided.

After that, you'll need to zip the correct folder. The manifest.json file must sit at the root of the ZIP and not inside a parent folder. If you use a bundler, zip the build output, not your source. The zip command is provided with instructions.

The next steps involve filling out the three tabs on the dashboard after uploading the ZIP. The Store listing includes the name, summary, detailed description, category, language, icon, and screenshots. The Privacy tab requires a single purpose, a justification per permission, data-use disclosures, and a privacy policy URL. The Distribution tab involves setting regions, pricing, and visibility options. It's crucial to provide clear answers as vague responses can hurt your submission.

Once the submission is complete, the approval process typically takes a few hours to a few days. However, sensitive permissions or large codebases may extend this time. It's essential to budget your time accordingly and avoid scheduling a launch on the same day you submit. Every update requires a higher version number, and you should avoid adding sensitive permissions casually.

The update loop is straightforward: bump the version, re-zip, upload the new package, and submit. Users will receive the update automatically over the following hours. To keep the process painless, never reuse a version number, keep permissions stable, and provide real release notes. These actions build trust with users and show reviewers what changes have been made.

The key takeaways from this process are the importance of narrow permissions, ensuring the ZIP file has manifest.json at the root, and thoroughly reviewing the Privacy tab. Remember that every update needs a higher version number, and avoid adding sensitive permissions carelessly. Approval is only the starting point, and once your extension is live, you can list it on ExtensionLaunch, a launch platform for browser extensions, to gain early installs and feedback.

Written by urgent.news from Dev.to's reporting — not their text. Machine-written — may contain errors; check the original before relying on it.

Read the original at dev.to →

More in Tech

I Wasted 3 Days on Google Drive 'Open With' OAuth — Here's Everything I Learned

Three days. That's how long it took me to fix a single OAuth error that, in hindsight, had a five-minute solution. The catch? The fix was in a place I never thought to look.

  • Three days spent resolving OAuth error with Google Drive Open With app
  • Redirect URI mismatch due to ngrok URL hard-coded in openUrlTemplate
  • Actual redirecturi obtained from Chrome DevTools and queried via access token

TraceScope 0.3.6: USB crash capture for crashes that never reach the APM

TraceScope is an MIT-licensed plugin for DeepSeek Harness with three capabilities: functional impact analysis, design diff analysis, and crash analysis.

  • TraceScope 0.3.6 introduces Local crash capture feature
  • Captures crashes and ANRs from USB-connected devices
  • Saves and displays crashes locally for analysis

How to Plan Separate WAF Rate Limits for Different URL Paths

A login endpoint and a product catalog rarely need the same traffic policy. Login attempts can be expensive or security-sensitive, while browsing often produces legitimate bursts.

  • Distinguish URL paths by functionality (e.g., /login vs /api/search)
  • Determine rate limit measurements (IP, account, time window, threshold)
  • Verify SafeLine's support for path-specific rate limits through testing

Shared WAF Limits vs Path-Specific Limits: How to Choose Enforcement Placement

A login endpoint, a search page, and a static asset directory rarely have the same traffic pattern. Applying one request threshold across all three can create a difficult tradeoff: tolerate expensive…

  • Shared WAF limits offer operational simplicity but lack precision in traffic enforcement.
  • Path-specific limits allow application context and precise control over endpoint budgets.

More from Thursday 12 November →