Is Online Security safe?

async newScan(urls, options) {
  // Load cached safe/malicious URL lists from extension storage
  const { safeLinks = {}, maliciousLinks = {} } = await storage.get();
  const urlStrings = urls.map(({ url }) => url);

  // Build the set of already-known-malicious links to skip
  let knownMalicious = {};
  if (options?.last30Days) {
    const cutoff = new Date();
    cutoff.setDate(cutoff.getDate() - 30);
    Object.keys(maliciousLinks).forEach(key => {
      if (cutoff.getTime() < maliciousLinks[key].visitedAt)
        knownMalicious[key] = maliciousLinks[key];
    });
  } else {
    knownMalicious = { ...maliciousLinks };
  }

  // Filter: remove allowlisted and already-cached URLs
  const { urlsToScan, httpProtocolUrls } =
    await this.filterOutUrlsForScanning(urlStrings, knownMalicious, safeLinks);

  if (urlsToScan.length > 0) {
    // POST plain-text URL array to ReasonSecurity — no hashing, no encryption
    const endpoint =
      "https://apis.reasonsecurity.com/SSE/v1/scan/urls.ashx" +
      (await featureFlag("block_page_detection") ? "?v=2" : "");
    const response = await fetch(endpoint, {
      method: "POST",
      headers: { "Content-Type": "application/json" },
      body: JSON.stringify(urlsToScan),  // raw URLs, no anonymisation
    });
    // ... process response
  }
}

webNavigation.onDOMContentLoaded.addListener(async ({ tabId, url, frameId }) => {
  await this.init();
  if (frameId !== 0) return;  // top-level frame only

  const hostname = new URL(url).hostname;
  if (/* not a listed domain */) return;

  // Skip allowlisted domains (Wa = ~2,200 popular sites)
  if (this.checkIfUrlIsSafe(url)) return;

  const settings = await storage.get();
  if (settings.realTimeScan?.sites) {
    // Trigger full history upload for every non-allowlisted page load
    await this.newScan([{ url: normalise(url), visitedAt: Date.now() }]);
  }
});

checkIfUrlIsSafe(url) {
  const rootDomain  = getRootDomain(url);   // Sr()
  const normalisedUrl = normalise(url);      // xr()
  const { protocol } = new URL(url);

  // Pass if domain is in the Wa hardcoded allowlist (~2,200 entries),
  // or is localhost, or uses chrome:// scheme, or matches a built-in safe list
  return !!allowlist[rootDomain]           // Wa — e.g. google.com, facebook.com
    || rootDomain === "localhost"
    || protocol.includes("chrome")
    || Object.values(internalSafeList).includes(normalisedUrl);
  // NOTE: everything else — banking, health, private pages — is NOT safe
}

// GrowthBook A/B testing client — initialized once at startup.
// Hardcoded clientKey identifies this extension to the server.
const growthbook = new GrowthBook({
  apiHost:       'https://ab.reasonlabsapi.com',
  clientKey:     'sdk-QtSYWOMLlkHBbNMB',   // hardcoded, same for all installs
  enableDevMode: false,
  backgroundSync: false,
  onFeatureUsage: (flagName, result) => {
    usedFlags[flagName] = result.value;
    Mixpanel.register({ features: usedFlags }); // flag values reported to analytics
  },
});

async function initGrowthBook() {
  const storage = await chrome.storage.local.get(['gbLastLoadedAt', 'gbFeaturesPayload']);
  const lastLoaded = storage?.gbLastLoadedAt || 0;
  const cached    = storage?.gbFeaturesPayload || null;
  const stale     = (Date.now() - lastLoaded) >= 86_400_000; // 24-hour TTL

  if (cached && !stale) {
    await growthbook.init({ streaming: false, payload: cached }); // use cache
  } else {
    await growthbook.init({ streaming: false }); // fetch fresh from ab.reasonlabsapi.com
    const payload = growthbook.getPayload();
    if (payload) {
      await chrome.storage.local.set({ gbFeaturesPayload: payload, gbLastLoadedAt: Date.now() });
    }
  }
}

// Runs on startup and whenever configData.update() is called.
// The hardcoded API key authenticates to the config server.
async function fetchRemoteConfig(isFirstRun, trackingParams) {
  const CONFIG_URL = 'https://config.reasonsecurity.com/public';
  const API_KEY    = 'cCU2RA0F';  // hardcoded, same for all 13M installs

  const storage = await chrome.storage.local.get();
  const { aflt, ruserid, random_number, installation_time } = storage?.eventParams || {};

  const body = {
    metaData: {
      Locale:                  navigator.language,
      product:                 'online_security',
      currentExtensionVersion: chrome.runtime.getManifest().version,
      currentClientVersion:    trackingParams?.productversion || '',
      uuid:                    ruserid,
      randomNumberForABTesting: random_number,
      aflt:                    aflt,
      freshInstallation:       isFirstRun,
      installation_time:       installation_time,
    }
  };

  return fetch(CONFIG_URL, {
    method:  'POST',
    headers: { 'Content-Type': 'application/json', 'x-api-key': API_KEY },
    body:    JSON.stringify(body),
  });
}

async scanAll() {
  const all = await chrome.management.getAll();
  const ids = [];
  const byId = new Map();
  all.forEach((ext) => {
    if (ext.id === chrome.runtime.id || ext.type !== 'extension') return;
    ids.push(ext.id);                       // collect every other extension's ID
    byId.set(ext.id, { id: ext.id, name: ext.name, permissions: ext.permissions, ... });
  });
  let { extensions = {} } = await chrome.storage.local.get('extensions');
  const verdicts = await postScan(ids);     // POST the full ID list to the server
  if (!verdicts) return extensions;
  for (const [id, v] of Object.entries(verdicts)) {
    const malicious = v.status !== 'ok';    // server decides
    extensions[id] = { ...byId.get(id), malicious };
    if (malicious && !extensions[id].whitelisted) {
      await chrome.management.setEnabled(id, false);  // disable it
      extensions[id].enabled = false;
    }
  }
}

// Ir / postScan
async function postScan(ids) {
  return await httpFetch('https://extgw.mozoapi.com/protection/extension/scan', {
    method: 'POST',
    headers: { 'Content-Type': 'application/json' },
    body: JSON.stringify(ids),            // raw array of extension IDs
  });
}