Chrome Web Store preflight checker
Scan the exact ZIP you plan to submit for manifest, permission, remote-code and packaging issues. The analysis runs entirely inside your browser.
Each claim has an independent check.
Load the page once, disconnect, then scan normally.
Open the network panel. The body we send is printed above.
This build names the exact public commit its engine came from.
Your file is read in this tab and never sent to a server.
Not ready to hand over a file? Read the Dark Reader sample first.
Your ZIP and scan results never leave this browser. We record only aggregate page views, scan counts and errors, never file information or findings.
Nothing sent yet.
Prefer your terminal? Run the scanner locally from source.
Dark Reader 4.9.130, read from its public release and scanned in this tab.
darkreader-chrome-mv3.zip Download the same ZIP from Dark Reader
The last two are weaker evidence than the rest, and every finding says which it used. A text search and a statistical heuristic can be wrong in ways a manifest key cannot.
It reads your package. That is all it reads. It has no idea what your store listing says, whether your privacy policy matches your code, or whether your extension works at all. Those account for most rejections and this tool will never catch them.
It reads text files only and skips images, fonts and binaries, which is why every report says how many of your files it actually opened.
A clean scan here is not a promise of approval, and I am not going to pretend otherwise.
For the checks this scanner cannot make, work through the Chrome Web Store submission checklist, which covers the listing, privacy and functional tests alongside the package rules.
This hosted site runs the scanner engine from the public AGPL-3.0 repository. The hosted interface is deployed separately and is not published. The engine in this build came from the commit named below, and a test fails if the two drift apart.
Run it yourself: npm install then
npx vite-node scripts/scan-zip.ts your-extension.zip
Extension Preflight records aggregate page views and completed scans so I can tell whether the tool is useful. It does not use scan results for analytics.
page_view records that this page was opened.scan_started records that a scan began. Nothing about the file.scan_completed records that a scan finished, and how long it took.scan_failed records why a scan could not finish.rule_errored records which of our rules threw.app_error records where our own code broke.Your files, manifest, file names, hashes, permissions, findings and generated justifications are never transmitted. The server also records the country of the request and the build identifier. The body printed above is what the browser sends.
The page view and the three scan events also carry how you got here, as one of seven
words:
google, reddit, github, medium,
x, direct or other. It comes from a campaign tag
in the address or the hostname that linked you, never the full address, the path or
anything you searched for. It is held for this browser session only and is not an
identifier: it cannot distinguish you from anyone else who arrived the same way.
Nothing on this page comes from anyone else's server either. No fonts, no CDN, no analytics script, no cookies.