Checking in on Featured Badge Nomination for Bookmark CE

[Nitesh Tyagi]

Hi,

I'm writing to check on the status of a Featured badge nomination I submitted about two weeks ago through One Stop Support for my extension, Bookmark CE: AI Bookmark Manager.

I know the review process takes time, and I'm not expecting an instant turnaround. I'm mostly hoping to confirm the nomination wasn't lost, and if a decision has already been made, I'd really value any constructive feedback.

For context, here's what I've done to align with the Featured badge criteria:
- Built entirely on Manifest V3 with a minimum Chrome version of 114
- Broad site access is handled through optional_host_permissions, not hard host_permissions
- Hard permissions are scoped to my own API domains only
- Uses modern platform APIs (Side Panel, Offscreen)
- Store listing includes detailed description, screenshots, and privacy policy

I do inject a content script on all URLs since the extension needs to function as a universal bookmark tool across any page, and I'm aware that broad content script scope can be a concern. If that's a sticking point, I'd appreciate guidance on how to address it while preserving the core functionality.

Here is my Extension ID for reference: kndkglmpbfjgomlenokfiikgmjdhpmpl

I'm fully open to making changes if there are specific areas that need improvement.

Thanks for any help, happy to provide the extension ID or answer questions.

[Mythical 5th]

> Hard permissions are scoped to my own API domains only

When I clicked to install it, I was warned that the extension can "Read and change all your data on all websites". This is due to the "<all_urls>" permission in the content_scripts section of the manifest. There's no point scoping other permissions when that's there!

I can't comment on the review process, but as a developer I would expect a Bookmarks extension to want to access only the current tab. Scripts can be injected with the activeTab permission after the toolbar button is clicked.

Your manifest references "localhost:3000" and "testapp.bookmarkce.io" several times, which ought to be removed from the released product. Assuming the <all_urls> permission can be removed, having the localhost and testapp permissions in the manifest will still push the warning message past a tipping point so that it states "Read and change your data on a number of websites". If you request access to "*.bookmarkce.io" instead, the message will be "Read and change your data on all bookmarkce.io sites". Listing the 3 required subdomains individually will result in a wordy warning message.

Manifest warnings can be checked with "chrome.management.getPermissionWarningsByManifest()"