No global host permissions (all_urls)

Requesting <all_urls> or *://*/* in host_permissions grants your extension read and write access to every page the user visits — every banking session, every health portal, every private message thread. Chrome's permission-warning system flags this with a maximally alarming install dialog ('Read and change all your data on all websites'), crushing install conversion. Per the Chrome Web Store policy on host permissions, extensions must request only the minimal host access needed. CWE-250 applies: any code executing with <all_urls> access runs at a privilege level that makes a single XSS or supply-chain vulnerability into a total browsing-history exfiltration event.

Replace wildcard host patterns with explicit domains in manifest.json. If you access only GitHub and GitLab, list exactly those.

"host_permissions": [
  "https://github.com/*",
  "https://gitlab.com/*"
]

If you need user-triggered access to arbitrary pages, use activeTab instead of host permissions — it requires no install-time grant and shows no permission warning.