There's some criteria by which it just goes through without human code review. I don't know what the exact criteria are, but I imagine it's something like if yo

There's some criteria by which it just goes through without human code review. I don't know what the exact criteria are, but I imagine it's something like if your extension never connects to the internet and doesn't interact with webpages and so on, it's basically impossible for it to be malicious, so gets a pass. But otherwise, yeah, there is someone who actually reads the code. They probably use automated tools as well, but then in addition.