Is Epic Games Store - Free Games Reminder safe?
We analyzed Epic Games Store - Free Games Reminder version 1.0.10's actual code and gave it a 94/100 trust score. This appears to be a narrowly scoped,…
Bottom line
This appears to be a narrowly scoped, purpose-appropriate reminder extension with no established abuse or meaningful security weakness.
What it can access
It uses reminders, notifications, local storage, and one Epic Games service, all fitting its stated purpose.[Q1]
Security weaknesses
No meaningful security weakness was found: code is readable, does not execute downloaded data, and exposes no ordinary-website control path.[Q10][Q11][Q21]
Signs of misuse
No evidence shows tracking, collection of private data, or remote commands; requests are limited to public Epic promotion data.[Q6][Q12][Q14][Q16]
Code findings
What access does this extension ask for, and does that access make sense for what it claims to do?
It requests alarms, notifications, local storage and access to Epic's free-games services. Those permissions closely match its reminder feature.
Declares only alarms, notifications, storage and the single Epic API host. — manifest.json:14-23
Uses those capabilities to fetch promotions, schedule reminders and notify the user. — service_worker.js:51-90,125-158
Which websites can it run on, and can it read or change what appears on those pages?
No evidence of this behavior was found in the reviewed package.
Contains no content_scripts or broad host match; the action opens popup/popup.html. — manifest.json:14-24
Defines a small extension-owned popup for the current games and countdown. — popup/popup.html:1-15
Can it see sensitive information you type, such as passwords, payment details, messages, or form entries?
No evidence of this behavior was found in the reviewed package.
No webpage injection capability is declared. — manifest.json:14-24
Popup code only displays Epic catalog data and handles game clicks. — popup/popup.js:1-94
Can it access private browser data such as cookies, signed-in sessions, browsing history, bookmarks, or downloads?
No evidence of this behavior was found in the reviewed package.
Requests only alarms, notifications and storage. — manifest.json:14-17
Stores last-check time and fetched Epic JSON locally. — service_worker.js:6-14,51-65,138-148
Can it access anything else on your device, such as files, location, camera, microphone, clipboard, or installed applications?
No evidence of this behavior was found in the reviewed package.
Declares none of the relevant device or management permissions. — manifest.json:14-17
Manual source review found no corresponding APIs. — inventory.json:1
Does it send information outside your browser? If so, what information is sent, where does it go, and why?
It requests the public freeGamesPromotions feed from Epic. The request sends no user content, browsing data or extension-generated identifier; selected product pages are opened directly on Epic.
Fetches the fixed Epic endpoint without a request body and stores the response. — service_worker.js:51-65
Builds clicked notification destinations under https://store.epicgames.com/. — service_worker.js:96-117
Does it download or run code, settings, or instructions supplied by a remote server?
Epic supplies game titles, images, promotion dates and product slugs. Packaged code uses those values as display text, image sources, alarm times and fixed Epic Store paths; it does not treat them as code or general instructions.
Parses promotion records and schedules the next alarm from Epic dates. — service_worker.js:16-49,51-87
Sets title with innerText, thumbnail with img.src and product destination beneath store.epicgames.com. — popup/popup.js:3-55
Can it take actions without a clear user request, such as opening pages, redirecting searches, downloading files, or sending requests?
It fetches updated promotions on browser startup and extension update, and shows reminders on an alarm. Opening game pages requires the user to click the notification or popup listing.
Automatic work is limited to refresh, badge and notification; tabs are opened from notification clicks. — service_worker.js:92-123,125-158
Popup product pages open from the user's click handler. — popup/popup.js:39-54
Can it change important browser settings, including your proxy, search engine, homepage, privacy settings, or other extensions?
No evidence of this behavior was found in the reviewed package.
Requests no browser-setting, proxy, search or management permission. — manifest.json:14-17
Is any important behavior difficult to inspect because the code is hidden, heavily obfuscated, dynamically generated, or supplied by third parties?
No evidence of this behavior was found in the reviewed package.
Lists only service_worker.js and popup/popup.js as application scripts. — inventory.json:1
The complete background behavior is readable source. — service_worker.js:1-206
Does it use eval(), new Function(), or string-based timers to turn text into executable code?
No evidence of this behavior was found in the reviewed package.
Manual fixed-string searches across all packaged JavaScript found no text-to-code primitive. — inventory.json:1
Does it track the websites, pages, searches, or links you visit?
No evidence of this behavior was found in the reviewed package.
No tabs, history or webpage content access is declared. — manifest.json:14-24
Creates only Epic product URLs from API-provided game slugs after a notification click. — service_worker.js:96-117
Does it create a persistent ID or browser fingerprint to recognize you?
No evidence of this behavior was found in the reviewed package.
lastCheckDate is compared with promotion dates; no value is transmitted. — service_worker.js:6-14,67-84,138-148
Does it send cookies, session details, authentication data, or page contents elsewhere?
No evidence of this behavior was found in the reviewed package.
Does not request cookies or webpage access. — manifest.json:14-17
Uses a plain GET to the fixed public Epic promotions endpoint. — service_worker.js:51-56
Does it record typing, form entries, clipboard contents, or screenshots?
No evidence of this behavior was found in the reviewed package.
Declares no content script or capture/clipboard permission. — manifest.json:14-24
Contains display and click code only, with no user text input. — popup/popup.js:1-94
Can a website or remote server send commands that make the extension take actions?
No evidence of this behavior was found in the reviewed package.
Maps API fields into a fixed set of operations. — service_worker.js:16-49,51-87,96-117
Has no externally_connectable declaration. — manifest.json:1-25
Does it alter links, referral codes, advertisements, shopping carts, or search results?
No evidence of this behavior was found in the reviewed package.
Prefixes every game destination with https://store.epicgames.com/ before assigning anchor.href and opening it. — popup/popup.js:28-54
No webpage injection is declared. — manifest.json:14-24
Does it redirect or modify web traffic, request headers, downloads, or proxy settings?
No evidence of this behavior was found in the reviewed package.
Requests no webRequest, declarativeNetRequest, downloads or proxy permission. — manifest.json:14-17
Creates new Epic tabs from notification clicks rather than redirecting current traffic. — service_worker.js:92-117
Can it communicate with software on the computer or services running on localhost?
No evidence of this behavior was found in the reviewed package.
The only fetch target is Epic's public HTTPS endpoint. — service_worker.js:51-56
Does not request nativeMessaging. — manifest.json:14-17
Does it decode, decrypt, or unpack hidden data and then execute or inject it?
No evidence of this behavior was found in the reviewed package.
Calls response.json and passes the object into fixed filtering/storage logic. — service_worker.js:51-68
Uses catalog fields through DOM text/src/href properties, not code execution. — popup/popup.js:3-55
Can ordinary websites access privileged extension features through messaging or exposed files?
No evidence of this behavior was found in the reviewed package.
Checks sender.url against chrome-extension://<own-id>/popup/popup.html and requires the exact currentGames message. — service_worker.js:160-205
Contains no externally_connectable or web-accessible command surface. — manifest.json:1-25
Does suspicious behavior activate only for certain users, websites, dates, or remote settings?
No evidence of this behavior was found in the reviewed package.
Uses promotion dates, alarms, install/startup events and notification clicks. — service_worker.js:67-90,92-158
Does it perform hidden resource-intensive work, such as cryptocurrency mining?
No evidence of this behavior was found in the reviewed package.
Contains simple catalog filtering and date calculations, not repeated compute or worker pools. — service_worker.js:51-90,125-158
Does it change form fields or where a form sends its information?
No evidence of this behavior was found in the reviewed package.
No webpage content script is declared. — manifest.json:14-24
Contains only headings, a games container and the packaged script. — popup/popup.html:1-15