{
  "id": 6482481,
  "title": "I shipped a Chrome extension, then found a permission bug and a hidden analytics call in the same week",
  "url": "https://urgent.news/2026/09/09/i-shipped-a-chrome-extension-then-found-a-permission-bug-and-a-hidden",
  "topic": "tech",
  "section": "Tech",
  "published": "2026-09-09T21:35:01.000Z",
  "source": {
    "name": "Dev.to",
    "slug": "dev-to",
    "url": "https://dev.to/tuna_ergnay_d1a1a5bf2f10/i-shipped-a-chrome-extension-then-found-a-permission-bug-and-a-hidden-analytics-call-in-the-same-5adi"
  },
  "original_language": "en",
  "account": "I developed a Chrome extension called Network Sniper to simplify debugging web applications by providing an editable, resend-capable request panel within DevTools. This extension eliminates the need to switch between tools and offers local-first design with no telemetry or cloud sync. When I launched Network Sniper, it received minimal attention, with only 15 installs after launch.\n\nSurprise #1: I initially requested excessive permissions. My first version asked for broad access to all websites, which was inconsistent with the tool's trustworthy, local-first promise. I fixed this by requesting permission only when the user needed it for a specific origin. This change removed the scary warning message displayed by Chrome.\n\nSurprise #2: Despite claiming zero telemetry, my extension contained a hidden Google Analytics property. This discrepancy was discovered during a full code audit, as the Developer Dashboard allowed linking a Google Analytics property for tracking listing page views. I added a regression test to scan the source tree and build output for analytics domains and SDK signatures, ensuring the extension remains telemetry-free. Network Sniper is now live, permission-minimal, and genuinely does not transmit any data. While growth is slow, the launch highlights the importance of shipping a product and the challenges of growing an audience beyond initial exposure.",
  "summary": "The problem I was scratching Every time I was debugging a web app, the same friction kept happening: I'd see a request in Chrome DevTools' Network tab, and to actually test a variation of it — a different header, a different body, a different query param — I had to copy it out to Postman or Insomnia, paste it in, re-add auth headers, and lose all the DevTools context in the process. Small…",
  "key_points": [],
  "editors_take": null,
  "illustration": null,
  "coverage": {
    "outlets": 2,
    "also_reported_by": [
      {
        "outlet": "Android Police",
        "title": "I found and turned off one setting in Chrome to save 2 hours' worth of battery",
        "url": "https://urgent.news/2026/09/10/i-found-and-turned-off-one-setting-in-chrome-to-save-2-hours-worth-of",
        "published": "2026-09-10T12:15:10.000Z"
      }
    ]
  },
  "ai_generated": true,
  "disclaimer": "Summaries, key points and the editor’s take are written by software from other outlets’ reporting and may contain errors — always check the linked original."
}