OP (or whoever authored the app), open your manifest.json file, go to line 20, and edit the permissions line to remove the all-domain permissions. Here are your current permissions:

  "permissions": [ "http://news.ycombinator.com/", "http://news.ycombinator.org/", "https://news.ycombinator.com/", "https://news.ycombinator.org/", "https://*/*", "http://*/*" ],

FTFY:

  "permissions": [ "http://news.ycombinator.com/, "http://news.ycombinator.org/, "https://news.ycombinator.com/, "https://news.ycombinator.org/],

I'm not going to read through all of your js to figure out what other domains you really need. Kudos on the idea -- I like it. Just not ideal to ship an app to this audience with the unnecessary security nail-biter during install. Fix and push and you should be good to go.

EDIT: Format