Texet URL Shortener

Texet URL Shortener has one purpose: to let a user shorten a URL with the Texet link-shortening service without leaving the browser. Everything the extension does serves that purpose — shortening the current tab's URL or a right-clicked link, optionally adding a custom alias, UTM campaign parameters or a custom domain, showing the QR code the service generates for the new short link, and listing the user's own recently created short links and their click counts. storage — Saves the signed-in session token, chosen custom domain and UTM defaults, the last shorten result, a local recent-links list for signed-out users, and the one-time claim tokens that let guest links be attached to an account at sign-in. Nothing else. contextMenus — Adds exactly two entries, "Shorten this link with Texet" and "Shorten this page with Texet", so the user can shorten without opening the popup. activeTab — Only on user invocation: reading the current tab's URL to prefill the popup, and copying the resulting short URL to the clipboard on that tab. No page content is read. scripting — One use: after a right-click shorten, executeScript injects a one-off function into that tab that puts the short URL on the clipboard (temporary hidden textarea + copy command). No content scripts are registered, nothing is read from the page. notifications — Confirms the outcome of user-started actions: the short URL after a right-click shorten (and that it was copied), errors, and Google sign-in success/failure. Never promotional. tabs — The Google sign-in flow: the extension opens the OAuth tab itself and watches only that tab for the Texet callback URL carrying the access token, then closes it. Also used to open Texet analytics/account pages. No cross-tab browsing monitoring. Host permissions (https://xt1.in/*) — The Texet API: creating short links, sign-in, fetching verified custom domains, link history and click stats, the QR image, and claiming guest links. No wildcard host access; nothing is injected into sites the user visits. Remote code — Answer "No, I am not using remote code." Justification: all JS is bundled at build time by esbuild into popup.bundle.js, options.bundle.js and background.bundle.js, shipped inside the ZIP. No CDN, no external <script>, no eval/new Function. Network calls return JSON and a PNG — data, not code. Certification — Tick all three. Declare authentication information (email/password to the API, token stored locally) and website content / user activity (the URLs the user chooses to shorten). Not sold, not used for unrelated purposes, not for creditworthiness. Two items aren't on that tab — the publisher contact email and its verification are both on the Settings page, and the verification email has to be clicked before publish unblocks. One thing to expect: scripting + activeTab purely for clipboard copy is a common review flag. If it gets rejected, the fallback is dropping both and writing the short URL to the clipboard from the popup's own document context instead — the context-menu path would then show the URL in the notification without auto-copying.