Unused host permissions removed

CWE-250 governs unused host permissions: an extension holding a host permission for a domain it never contacts has an unnecessarily wide privilege envelope. If the extension is compromised — via a malicious dependency, an XSS in extension pages, or a supply-chain attack — it can make credentialed requests to any domain in its host_permissions list, not just the domains it was designed for. Chrome Web Store review specifically checks for host permissions that aren't justified by the extension's functionality. OWASP A01 (Broken Access Control) applies: the least-privilege principle requires pruning grants that are no longer needed.

Audit each host_permissions entry against fetch(), XMLHttpRequest, and webRequest listener calls in the codebase. Remove any domain with zero call sites.

"host_permissions": ["https://api.yourdomain.com/*"]

Run grep -r 'api.yourdomain.com' src/ before each release to confirm the permission is still actively used. If a permission was for a feature that was removed, delete it from the manifest in the same commit.