Notes on the permissions which Scratchpad uses:

"Open File ..." is really upload (i.e., load from disk).
"Save" and "Save As ..." are really download (i.e., save to disk). Scratchpad uses the Downloads permission for this reason. The extension Downloads API provides more functionality than HTML download, like feedback on whether the "save" was successful or not.
Scratchpad uses the Menus permission to add an item to the Tools menu.
Scratchpad uses the Storage permission to persist user preferences over time.
Scratchpad uses the <all_urls> permission to access all sources in all tabs to inject JavaScript, its core function.
Users can enable optional permissions as necessary for the code they write and run in Scratchpad.

Users who have Google Safe Browsing enabled will have network activity when saving files. Scratchpad itself never makes any network connection and sends no information anywhere. Users who don't wish to use Google Safe Browsing can disable it in the "Privacy & Security" tab of Firefox settings under "Deceptive Content and Dangerous Software Protection." In no particular order, features I currently intend to add eventually include:

More CodeMirror features enabled (The extension validator rejects a lot of it, so there could be some patching involved.)
Per-scratchpad settings

From the statistics pages, the oldest FF versions seen as users:

FF 72 on 31 Mar 2023 through 8 May
FF 79 on 8 Jan 2023 (then never again)
FF 84 on 21 Feb 2023 through 4 Jun

Developer response