Code is free of obfuscation and minification that hides logic
Why it matters
Chrome Web Store (chrome-cws-code-readability) prohibits obfuscated code — not minification for size, but intentional renaming and encoding that hides what the extension actually does. Extensions caught with obfuscated logic are removed from the store and may be permanently banned. From a user-trust perspective, an extension that hides its logic cannot be independently audited, which is a red flag for the millions of users who rely on community security reviews. ISO 25010 maintainability standards treat intentional obfuscation as a defect, not a feature.
Severity rationale
High because obfuscated code triggers store removal and prevents independent security auditing, hiding potentially malicious behavior from users.
Remediation
Use build tools that minify for size (terser, esbuild) but preserve readable source. Never use obfuscators like javascript-obfuscator or similar tools.
// BAD — obfuscated: hides logic from auditors and the store
const _0x4a2c = ['settings']; function _0x2b(_0xc) { return _0x4a2c[_0xc]; }
// GOOD — minified for size but readable before build
const configKey = 'user-settings';
function updateConfig(newSettings) { /* ... */ }
Provide source maps (.map files) alongside your production build so reviewers can inspect readable code. If your build pipeline produces unreadable output, check whether your bundler config has an obfuscation plugin enabled.
DetectionPro
The detection method for this pattern is part of AuditBuffet Pro.
The full method (what to look for, pass and fail conditions, and how results get reported) ships inside the Chrome Web Store Readiness Audit. The pattern definition, severity rationale, and remediation remain openly licensed under CC-BY-4.0.
External references
- external · chrome-cws-code-readability — Chrome Web Store — Code Readability Requirements (no obfuscation)
- iso-25010:2011 · maintainability — ISO 25010 — Maintainability
Taxons
History
- 2026-04-18·v1.0.0·Initial import from extension-store-readiness·automated