# Negative Reviews & Developer Replies — Full Evidence Collection
## Steam Inventory Helper (`cmeakgjggjdlcpncigglobpjbkabhmjl`) — companion to `REVIEW-MANIPULATION-EVIDENCE.md`

**Dataset.** 4,089 total reviews (full store history); 765 rated 1–2★; 286 carry a reply from **"SIH Tech Support — Developer"**; 222 distinct reply texts (heavily templated). Collected via Apify actor + Playwright lowest-rating pass, 2026-10-11. Theme classification is keyword-based on review text; yearly counts show when each complaint type peaked.

---

# 1. WHAT USERS WRITE (765 NEGATIVES, BY THEME)

| Theme | Count | Peak years | Substance |
|---|---|---|---|
| **Ads / gambling injection** | 313 | 2017 (114), 2025 (75), 2024 (35) | banners on Steam pages, casino ads, Kinguin referral, "ads for a couple of bucks" removal subscription |
| **Spyware / permissions / data** | 142 | 2017 (116), 2024 (8) | tracking clicks, `<all_urls>`, cookies, "read and change all your data" |
| **Review manipulation** | 46 | 2017 (17), 2015 (11), 2025 (6) | "manipulating reviews with bot accounts", "scammed reviews" |
| **Bugs / broken features** | 45 | spread | broken floats, sell buttons, rate-limits |
| **Money/items lost** | 29 | 2017 (18) | "sold my whole inv for 3 cents", wallet drained, scam accusations |
| **API key hijack** | 1 (explicit) | 2024 | "new [API key] was created" after use |

## 1.1 The three complaint waves (mirrors of monetization pushes)

**Wave 1 — Sept 2017 (369× 1★ that year; 121 reviews on 2017-09-19 alone).** Users linked press coverage:
> *"Steam Inventory Helper monitors your browsing activity!!! https://www.ghacks.net/2017/09/…"* — Daniel š, Oct 1, 2017
> *"SIH used to be a great addition to the Steam experience… [until the] script"* — zar athustra, Oct 11, 2017

**Wave 2 — June 2024 (50× 1★ that month).** The MV3 permission grab:
> *"spyware (requesting dangerous permissions)"* — Crap Head, Jun 26, 2024 (12 of 13 found helpful)
> *"- Read and change all your data on all websites - Manage your apps, extensions, and themes NO THANKS"* — Frowki, Jun 24, 2024 (19 of 23)
> *"Read and change all your data on all websites … WHY!"* — ls zhai, Jun 25, 2024 (10 of 11)

**Wave 3 — March–May 2025 (75 ad complaints; 28 negatives in March alone).** Ad injection goes live:
> *"Recently added gambling website ads everywhere."* — Mar 8, 2025
> *"Shady practice of adding gambling ads into all steam pages."* — Mar 8, 2025
> *"displays ads ;("*, *"embeds ads on steam"* — Mar 10, 2025
> *"Puts ads on my steam page and demands money to remove it."* — May 11, 2025
> *"like looking at a casino or something"* — Jun 13, 2026

The 2025-03 1★ wave is then drowned by the incentivized 5★ program (181× 5★ the same month — see main report §3).

---

# 2. WHAT THE DEVELOPER REPLIES (286 REPLIES, 222 TEMPLATES)

## 2.1 The copy-paste catalog (usage counts)

**T1 — ×31 (2025-04/05, the "partnered ads" admission):**
> *"Hello! Unfortunately, we had to add partnered ads to be able to support and further develop our free project. … **Partnered ads mean that we are given advertisements to display, and we simply show them.** Additionally, if a user decides to purchase our subscription, all ads will be immediately removed."*

**T2 — ×17 (June 2024, the MV3 deflection):**
> *"Hello! Starting from June 1, 2024, Google requires all extensions to migrate to the Manifest V3 standards… You can find detailed information about the permissions here: https://x.com/SteamInvHelper/status/…"*

**T3 — ×4 (2026-02):** *"At the moment, we only have one partner banner… you can simply purchase a subscription for just a couple of bucks."*

**T4 — ×3 (2026-01, the veiled legal threat):**
> *"…please note that we do not violate any applicable laws, operate in full compliance with Google's policies… **we would like to remind you that you bear responsibility for posting comments of this kind that may be considered unlawful.**"*

**T5 — ×3 (2025-10):** *"…we have added several slots for affiliate banners."*

**T6 — ×2 (2026-05, "Google reviews everything"):**
> *"It is very unfortunate to see misleading comments of this kind. The list of available requests and the extension's functionality is clearly described on the main page of the Google Marketplace, and additionally, **every version of our extension goes through Google's review process.**"*

**T7 — ×2 (2025-09, "one banner, Valve's tournament"):** *"We have only one affiliate banner advertising Valve's eSports tournament…"*

**T8 — ×2 (2024-08, Kinguin grey-market referral):** *"This is an optional promotional offer that can help save users money."*

## 2.2 One-off replies that matter

| Date | Reply | Significance |
|---|---|---|
| 2017-10-02 | *"This information is fake. We are not using any kind of script that is mentioned there."* (to the ghacks.net article) | Flat denial of the browsing-activity monitoring story |
| 2018-01-06 | *"**This was an old article with the outdated information. This analytics script was removed long ago and we are never bringing it back.**"* | **Admission that the "fake" script existed** — the 2017 spyware claim was true |
| 2017-09-19 | *"Extension is not able to steal anything."* / 2018-07-02: *"SIH never was harmful to user."* | absolute denials, contrast with §3 below |
| 2023-12-25 | *"…this service is more of a gambling project, so at the moment **we have no specific tasks to add and interact with gambling projects**."* (declining to add CSGOEmpire) | Two years later: CSGOFAST referral in the trade window + own case-opening site (`cases.steaminventoryhelper.com`) + gainskins gambling banners |
| 2025-03-24 | *"our extension does not collect authorization access, API keys, or any similar information"* | **False** — password login, Steam Guard registration, maFile cloud sync are all in the code |
| 2026-08-31 | *"The extension do not have access to API key so it can't be changed. It appears that you may have fallen victim to a phishing website or malware."* | Blames the victim; user reported a **newly created API key** after the extension logged them out |
| 2025-03-18 | *"someone has launched an entire anti-advertising campaign against SIH… tens of thousands of grateful users"* | Labels organic backlash a "campaign" while running the incentivized 5★ program (main report §2) |
| 2024-11-05 | *"We're very sorry that you continue to copy and post the same review from different accounts"* | Accuses critics of the exact astroturfing SIH itself runs |
| 2025-03-13 | *"If it's great we hope you will change your rate for 5 stars :)"* (and ×3 more 4★-review replies asking to raise the rating) | Rating solicitation in the store itself |
| 2020-10-21 | *"You can check our code and find nothing… only limited to these websites: steampowered, market.csgo.com, sih.gainskins.com, steamcharts, steamcommunity, steamrep"* | **Then-true** narrow permission list — became `<all_urls>` in 2024, making every later "check the permissions page" reply misleading |

---

# 3. REPLY vs. CODE vs. OWN ADMISSIONS — CONTRADICTION MATRIX

| Claim in replies | Contradicted by | Where |
|---|---|---|
| "Google's review process" covers the ads | their own T1: **"we are given advertisements to display, and we simply show them"** — ads are delivered to the client at runtime from `ads.steaminventoryhelper.com/adapi/<token>/find-all` with per-user targeting `{f:{…}}`; Google reviews submitted code, not the ad server's output | main report §4.1; 922.js:84640 |
| "we only have one partner banner" (T3/T5/T7, various) | their own T5 "several slots" + code: 5 adSpaceTokens (`marketSponsor`, `tradeoffer`, `marketLeftSideBanner`, `externalIntegrationBanner`, `marketSponsorBanner`), 4 ad networks + hardcoded RU-only `http://23.105.226.164` banner | main report §2.2; INTEGRATIONS.md |
| "no gambling affiliation" | T8 Kinguin referral; CSGOFAST `subid2=csgofast` in the trade window; gainskins gambling banner feed; `cases.steaminventoryhelper.com` case-opening with sell/withdraw commands | code audit §2.2 |
| "does not collect authorization access" | `IAuthenticationService/BeginAuthSessionViaCredentials` (password login), `ITwoFactorService/AddAuthenticator`, maFiles `shared_secret`/`identity_secret` uploaded to `core.sih.app/sih/backups/sync` | 922.js:99652 |
| "not able to steal anything" (2017) | own 2018 admission that an analytics/tracking script existed and was removed; current build: C2 `tradesend`/`tradeaccept`, `sell_item` tasks, auto-confirm | §2.2; C2 report §4 |
| "permissions only for SIH functions… check the store page" | 2020 reply itself listed 6 Steam domains — current manifest is `<all_urls>` + `cookies` + `webRequest` + `management` | manifest.json |

**Net pattern.** The reply operation uses (a) a true but irrelevant fact (Google code review) as a shield for runtime behavior Google cannot see, (b) minimization ("one small banner") disproven by their own other replies ("several slots") and the code, (c) historical absolute denials followed by later quiet admissions, (d) victim-blaming and legal-flavored threats toward critics, and (e) rating-solicitation even inside review threads.

---

# 4. FILES

- `%TEMP%\opencode\scraper\lowest_fixed.json` — 1,010 reviews parsed (lowest-rating pass)
- `%TEMP%\opencode\scraper\dev_replies.json` — 286 review+reply pairs
- `%TEMP%\opencode\scraper\unique_replies.json` — 222 deduplicated reply templates with usage counts and trigger reviews
- `%TEMP%\opencode\cws_all.json` — full 4,089-review dataset (Apify)

*Compiled 2026-10-11. Quotes are verbatim (typos included); "helpful" counts as shown on the store at scrape time.*