Is Online Security safe?

async newScan(urls, options) {  // Load cached safe/malicious URL lists from extension storage  const { safeLinks = {}, maliciousLinks = {} } = await storage.get();  const urlStrings = urls.map(({ url }) => url);  // Build the set of already-known-malicious links to skip  let knownMalicious = {};  if (options?.last30Days) {    const cutoff = new Date();    cutoff.setDate(cutoff.getDate() - 30);    Object.keys(maliciousLinks).forEach(key => {      if (cutoff.getTime() < maliciousLinks[key].visitedAt)        knownMalicious[key] = maliciousLinks[key];    });  } else {    knownMalicious = { ...maliciousLinks };  }  // Filter: remove allowlisted and already-cached URLs  const { urlsToScan, httpProtocolUrls } =    await this.filterOutUrlsForScanning(urlStrings, knownMalicious, safeLinks);  if (urlsToScan.length > 0) {    // POST plain-text URL array to ReasonSecurity — no hashing, no encryption    const endpoint =      "https://apis.reasonsecurity.com/SSE/v1/scan/urls.ashx" +      (await featureFlag("block_page_detection") ? "?v=2" : "");    const response = await fetch(endpoint, {      method: "POST",      headers: { "Content-Type": "application/json" },      body: JSON.stringify(urlsToScan),  // raw URLs, no anonymisation    });    // ... process response  }}

webNavigation.onDOMContentLoaded.addListener(async ({ tabId, url, frameId }) => {  await this.init();  if (frameId !== 0) return;  // top-level frame only  const hostname = new URL(url).hostname;  if (/* not a listed domain */) return;  // Skip allowlisted domains (Wa = ~2,200 popular sites)  if (this.checkIfUrlIsSafe(url)) return;  const settings = await storage.get();  if (settings.realTimeScan?.sites) {    // Trigger full history upload for every non-allowlisted page load    await this.newScan([{ url: normalise(url), visitedAt: Date.now() }]);  }});

checkIfUrlIsSafe(url) {  const rootDomain  = getRootDomain(url);   // Sr()  const normalisedUrl = normalise(url);      // xr()  const { protocol } = new URL(url);  // Pass if domain is in the Wa hardcoded allowlist (~2,200 entries),  // or is localhost, or uses chrome:// scheme, or matches a built-in safe list  return !!allowlist[rootDomain]           // Wa — e.g. google.com, facebook.com    || rootDomain === "localhost"    || protocol.includes("chrome")    || Object.values(internalSafeList).includes(normalisedUrl);  // NOTE: everything else — banking, health, private pages — is NOT safe}

// GrowthBook A/B testing client — initialized once at startup.// Hardcoded clientKey identifies this extension to the server.const growthbook = new GrowthBook({  apiHost:       'https://ab.reasonlabsapi.com',  clientKey:     'sdk-QtSYWOMLlkHBbNMB',   // hardcoded, same for all installs  enableDevMode: false,  backgroundSync: false,  onFeatureUsage: (flagName, result) => {    usedFlags[flagName] = result.value;    Mixpanel.register({ features: usedFlags }); // flag values reported to analytics  },});async function initGrowthBook() {  const storage = await chrome.storage.local.get(['gbLastLoadedAt', 'gbFeaturesPayload']);  const lastLoaded = storage?.gbLastLoadedAt || 0;  const cached    = storage?.gbFeaturesPayload || null;  const stale     = (Date.now() - lastLoaded) >= 86_400_000; // 24-hour TTL  if (cached && !stale) {    await growthbook.init({ streaming: false, payload: cached }); // use cache  } else {    await growthbook.init({ streaming: false }); // fetch fresh from ab.reasonlabsapi.com    const payload = growthbook.getPayload();    if (payload) {      await chrome.storage.local.set({ gbFeaturesPayload: payload, gbLastLoadedAt: Date.now() });    }  }}

// Runs on startup and whenever configData.update() is called.// The hardcoded API key authenticates to the config server.async function fetchRemoteConfig(isFirstRun, trackingParams) {  const CONFIG_URL = 'https://config.reasonsecurity.com/public';  const API_KEY    = 'cCU2RA0F';  // hardcoded, same for all 13M installs  const storage = await chrome.storage.local.get();  const { aflt, ruserid, random_number, installation_time } = storage?.eventParams || {};  const body = {    metaData: {      Locale:                  navigator.language,      product:                 'online_security',      currentExtensionVersion: chrome.runtime.getManifest().version,      currentClientVersion:    trackingParams?.productversion || '',      uuid:                    ruserid,      randomNumberForABTesting: random_number,      aflt:                    aflt,      freshInstallation:       isFirstRun,      installation_time:       installation_time,    }  };  return fetch(CONFIG_URL, {    method:  'POST',    headers: { 'Content-Type': 'application/json', 'x-api-key': API_KEY },    body:    JSON.stringify(body),  });}

async scanAll() {  const all = await chrome.management.getAll();  const ids = [];  const byId = new Map();  all.forEach((ext) => {    if (ext.id === chrome.runtime.id || ext.type !== 'extension') return;    ids.push(ext.id);                       // collect every other extension's ID    byId.set(ext.id, { id: ext.id, name: ext.name, permissions: ext.permissions, ... });  });  let { extensions = {} } = await chrome.storage.local.get('extensions');  const verdicts = await postScan(ids);     // POST the full ID list to the server  if (!verdicts) return extensions;  for (const [id, v] of Object.entries(verdicts)) {    const malicious = v.status !== 'ok';    // server decides    extensions[id] = { ...byId.get(id), malicious };    if (malicious && !extensions[id].whitelisted) {      await chrome.management.setEnabled(id, false);  // disable it      extensions[id].enabled = false;    }  }}

// Ir / postScanasync function postScan(ids) {  return await httpFetch('https://extgw.mozoapi.com/protection/extension/scan', {    method: 'POST',    headers: { 'Content-Type': 'application/json' },    body: JSON.stringify(ids),            // raw array of extension IDs  });}