Upload an unpublished extension's .zip file or manifest.json file to get a permission-based security score.
Files are analyzed in memory and never stored. Extension code is never executed, only manifest.json is read, whether it arrives inside a zip or on its own.