Make sure the developer is legitimate. Extension developers should have a public profile or website somewhere that can verify their identity. There are also plenty of fake extensions masquerading as the real thing. So make sure the developer matches the software. For instance, Instagram wouldn't have been made by some random person - since it's owned by Facebook.