Audit extension permissions and document why each is needed

[aadityat23]

Category: Cybersecurity / Extension · Difficulty: Beginner · Effort: Small · Priority: Contributor-friendly

Skills: Chrome extension security model, MV3 permissions

Good for: Cybersecurity Intern

Description: manifest.json requests storage and a host_permissions entry scoped to the HF Space API. Worth a documented review confirming least-privilege, especially before wider public distribution (README calls the extension "in active development").

Expected outcome: A short SECURITY_REVIEW.md (or a section in SECURITY.md) explaining what each permission is for and confirming no broader host access is requested than needed.

Acceptance criteria:

• Every permission in manifest.json has a documented justification; any unused/unnecessary permission is flagged as a follow-up (not necessarily removed in this issue, unless trivial).

Files: finverify-extension/apps/extension/manifest.json, SECURITY.md

Labels: security, extension, good first issue