Is Finance Sage - personal finance manager safe?
We analyzed Finance Sage - personal finance manager version 1.1.0's actual code and gave it a 88/100 trust score. Finance Sage is a narrowly scoped local…
Bottom line
Finance Sage is a narrowly scoped local finance tool with modest privacy risk because it stores the financial information you enter.
What it can access
It requests only local storage and handles your finance records, preferences, and requested reports locally, matching its purpose. [Q1][Q3][Q4][Q5]
Security weaknesses
No website access, remote-code loading, code execution, or exposed privileged features were found. [Q2][Q7][Q11][Q21]
Signs of misuse
No evidence shows outside data sharing, browsing tracking, session collection, or remote commands. [Q6][Q12][Q14][Q16]
Code findings
What access does this extension ask for, and does that access make sense for what it claims to do?
It has access only to its own extension pages and local storage, with no website website access.
Requests storage only and declares no content scripts or host permissions. — manifest.json:4-35
Which websites can it run on, and can it read or change what appears on those pages?
No evidence of this behavior was found in the reviewed package.
No content scripts, scripting permission, activeTab permission, or host permissions are declared. — manifest.json:4-35
Can it see sensitive information you type, such as passwords, payment details, messages, or form entries?
It reads financial records the user enters into the extension's own transaction form.
Reads type, amount, description, category, date, and recurring status from its own form and adds a transaction record. — popup.js:654-684
Can it access private browser data such as cookies, signed-in sessions, browsing history, bookmarks, or downloads?
It stores transaction records, categories, language, and promo preferences in chrome.storage.local.
Loads and saves transactions, expense categories, income categories, and a promo-dismissal flag in local storage. — popup.js:361-378
Loads and saves the selected language in local storage. — i18n-helper.js:21-25,121-137
Can it access anything else on your device, such as files, location, camera, microphone, clipboard, or installed applications?
It creates local CSV, text, and PDF downloads when the user requests an export.
Builds report content locally, creates a Blob or jsPDF document, and invokes a browser download from the extension page. — popup.js:1890-1927,1959-2124
Does it send information outside your browser? If so, what information is sent, where does it go, and why?
No evidence of this behavior was found in the reviewed package.
Its fetch URL is built with chrome.runtime.getURL and loads a packaged locale file. — i18n-helper.js:62-84
The other application fetch loads the packaged LICENSE file through a chrome.runtime URL. — popup.js:1809-1818
Does it download or run code, settings, or instructions supplied by a remote server?
No evidence of this behavior was found in the reviewed package.
The package has no remote host permissions and all application resources are packaged locally. — manifest.json:4-35
Can it take actions without a clear user request, such as opening pages, redirecting searches, downloading files, or sending requests?
It locally calculates recurring transactions when a user views later months; it does not send or post them anywhere.
Derives display-only recurring entries from user-created templates while rendering a selected month. — popup.js:771-840
Can it change important browser settings, including your proxy, search engine, homepage, privacy settings, or other extensions?
No evidence of this behavior was found in the reviewed package.
Requests only the storage permission. — manifest.json:9-11
Is any important behavior difficult to inspect because the code is hidden, heavily obfuscated, dynamically generated, or supplied by third parties?
No evidence of this behavior was found in the reviewed package.
Uses descriptive class, method, and variable names throughout the finance application. — popup.js:1-2125
Calls the packaged jsPDF API only in the explicit PDF export flow. — popup.js:1959-2107
Does it use eval(), new Function(), or string-based timers to turn text into executable code?
No evidence of this behavior was found in the reviewed package.
The active scripts are packaged extension resources with no remote script or code source. — manifest.json:4-35
Does it track the websites, pages, searches, or links you visit?
No evidence of this behavior was found in the reviewed package.
Requests no tabs, history, webNavigation, or host permission. — manifest.json:9-11
Does it create a persistent ID or browser fingerprint to recognize you?
No evidence of this behavior was found in the reviewed package.
Stored values are finance records and interface preferences; no identifier or telemetry field is created. — popup.js:361-378
Does it send cookies, session details, authentication data, or page contents elsewhere?
No evidence of this behavior was found in the reviewed package.
Requests no cookies or website-access permission. — manifest.json:9-11
Does it record typing, form entries, clipboard contents, or screenshots?
No evidence of this behavior was found in the reviewed package.
Reads the extension's own transaction fields when its form is submitted. — popup.js:654-684
Has no website, capture, camera, or microphone access. — manifest.json:4-35
Can a website or remote server send commands that make the extension take actions?
No evidence of this behavior was found in the reviewed package.
The only fetched JSON is a fixed packaged translation file, not a server response. — i18n-helper.js:62-84
Does it alter links, referral codes, advertisements, shopping carts, or search results?
No evidence of this behavior was found in the reviewed package.
Declares no page injection mechanism or host access. — manifest.json:4-35
Does it redirect or modify web traffic, request headers, downloads, or proxy settings?
It downloads user-created reports locally but does not intercept, redirect, filter, or proxy network traffic.
Creates an object URL from locally generated content and clicks a temporary download link. — popup.js:2115-2124
Requests no webRequest, declarativeNetRequest, proxy, or downloads permission. — manifest.json:9-11
Can it communicate with software on the computer or services running on localhost?
No evidence of this behavior was found in the reviewed package.
Requests no nativeMessaging permission. — manifest.json:9-11
Does it decode, decrypt, or unpack hidden data and then execute or inject it?
No evidence of this behavior was found in the reviewed package.
Loads only packaged locale JSON using chrome.runtime.getURL. — i18n-helper.js:62-84
Loads only the packaged LICENSE text using chrome.runtime.getURL. — popup.js:1809-1818
Can ordinary websites access privileged extension features through messaging or exposed files?
No evidence of this behavior was found in the reviewed package.
Declares no content scripts or externally_connectable entry. — manifest.json:4-35
Does suspicious behavior activate only for certain users, websites, dates, or remote settings?
No evidence of this behavior was found in the reviewed package.
Binds behavior to the finance app's visible controls and forms. — popup.js:381-545
Requires confirmation for deletion and supports dismissing the promotion. — popup.js:693-745
Does it perform hidden resource-intensive work, such as cryptocurrency mining?
No evidence of this behavior was found in the reviewed package.
Computation consists of local transaction filtering, recurring-entry generation, and totals. — popup.js:771-880
Does it change form fields or where a form sends its information?
No evidence of this behavior was found in the reviewed package.
Cannot inject into external pages; its only form handling is inside popup.html. — manifest.json:4-35