Purple Potassium: Excessive permissions

The fix: rejected → fixed

{  "manifest_version": 3,  "name": "PR Notes for GitHub",-Removed:   "permissions": ["tabs", "storage", "cookies", "scripting"],-Removed:   "host_permissions": ["<all_urls>"],+Added:   "permissions": ["storage"],  "content_scripts": [{-Removed:     "matches": ["<all_urls>"],+Added:     "matches": ["https://github.com/*/pull/*"],    "js": ["content.js"]  }]}

This extension only works on GitHub pull requests, and a declared content script needs no extra host permission for its own matches. So <all_urls>, tabs, cookies and scripting (none of which the code called) all went. Only storage remains.

Why you got Purple Potassium

• "tabs" requested just to read the current tab's URL from a popup. "activeTab" covers that when the user clicks your icon.
• "<all_urls>" or "*://*/*" host access when the extension only works on one or two sites.
• Leftovers from a boilerplate or tutorial: "cookies", "history", "webRequest" or "notifications" with no matching chrome.* call.
• Content scripts injected on every site when the feature only runs on one domain.
• Permissions added "for later" that the current version never uses.

Pre-resubmit checklist

Your ticks are saved in this browser.

1. List every chrome.* API your code calls. Searching the package for chrome\. is a quick way.
2. Match each permission in the manifest to one of those calls. Delete any permission with no match.
3. Replace "tabs" with "activeTab" if you only act on the tab the user clicked. If you already have host permissions for the sites you act on, you don't need "activeTab" either.
4. Narrow host_permissions and content_scripts.matches to the domains you actually use.
5. Move rarely used access to optional_permissions / optional_host_permissions and request it at runtime.
6. For each permission that remains, write a one-sentence justification in the dashboard's Privacy practices tab.
7. Bump "version", zip the package and resubmit.

Common mistake: Appealing without changing anything rarely works for this code. If you truly need a broad permission, the appeal has to name the exact feature that uses it and why a narrower option can't work.

Appeal or resubmission note

Replace the [BRACKETS], then use the appeal link in your rejection email. Keep it short and factual, and list only changes you actually made.

Hello Chrome Web Store team,

My item [EXTENSION NAME] (ID: [ITEM ID]) was rejected with reference Purple Potassium.

I have reviewed the policy and made the following changes in version [NEW VERSION]:
- Removed unused permissions: [LIST].
- Replaced "tabs" with "activeTab" (we only read the tab the user clicks on).
- Narrowed host access from all sites to [DOMAINS].

[ONE SENTENCE ON WHAT THE EXTENSION DOES AND WHY IT NEEDS WHAT REMAINS.]

I have resubmitted the updated package. If anything still does not comply, I would appreciate a pointer to the specific file or listing field so I can fix it.

Thank you,
[YOUR NAME]

Other fix guides

• Blue Argon Remotely hosted code (Manifest V3)
• Blue Zinc Prohibited products
• Yellow Magnesium Functionality not working
• Yellow Zinc Missing or insufficient metadata
• Purple Lithium Privacy policy missing or incomplete
• Red Nickel Deceptive behavior
• Red Titanium Obfuscated code