Is SetupVPN - Lifetime Free VPN safe?

// UPDATE_SERVERSJSON is the Redux action type that replaces all API endpoints.const UPDATE_SERVERSJSON = 'UPDATE_SERVERSJSON';// Hardcoded fallback config — used only if no CDN mirror is reachable.// In practice, getTiers() fires at startup and CDN response overwrites this immediately.const DEFAULT_SERVER_CONFIG = { retcode: 200, data: { version: 4, update_interval_hours: 6, // server can change this mainbase: [ // 12 API endpoints — all fingerprinted requests go here 'https://lllm.scanners.fun', 'https://uabh.talked.run', 'https://mjgu.figure.run', 'https://xcxx.pointed.cc', 'https://uaia.scanners.fun', 'https://icax.figure.run', 'https://1.foreground.work', 'https://1.awakened.work', 'https://1.6912044.cc', 'https://1.default2024.uk', 'https://1.sahi.uk', 'https://1.area9.uk' ], tierbase: [ // 5 secondary endpoints 'https://sxkk.pointed.cc', 'https://api.keepthisdomain.com', 'https://1.allnine.uk', 'https://ksho.uk', 'https://3245.uk' ], mirrors: [ // 7 CDN mirrors tried in order 'https://tierbase3.fra1.cdn.digitaloceanspaces.com/tierssv.json', 'https://tierbase4.s3.amazonaws.com/tierssv.json', 'https://pub-8029ed10cf4e4db0b3757e6b82ef7a40.r2.dev/tierssv.json', 'https://ams1.vultrobjects.com/tierupdate2/tierssv.json', 'https://mirror4.es-mad-1.linodeobjects.com/tierssv.json', 'https://raw.githubusercontent.com/the7c/update/master/master/ui/data.json', 'https://bitbucket.org/the7c/update/raw/master/edge/pub/data.json' ] }};

// On startup: create a repeating alarm named 'int1' tied to getTiers().// updateIntervalTime is derived from update_interval_hours in the last fetched config.this.updateInterval = new IntervalTimer( this.getTiers.bind(this), this.updateIntervalTime, // default 6 hours = 21600000ms; server-adjustable 'int1' // alarm name visible in chrome.alarms);this.updateInterval.start();this.getTiers(); // also fires immediately at startup// isValidTierResponse() accepts the response only if:// retcode === 200// mainbase.length > 2// tierbase.length > 2// update_interval_hours must be integer 1 < x < 168 (1 week max)

// Loads main.wasm and wraps all exported Go functions in a Promise-based proxy.const zi = (() => {  let wasmReady = false;  async function initWasm(wasmBytesPromise) {    const go = new Go();  // Go WASM runtime helper (wasm_exec.js)    const bytes = await wasmBytesPromise;    const instance = await WebAssembly.instantiate(bytes, go.importObject);    go.run(instance.instance);    wasmReady = true;  }  initWasm(fetch('/main.wasm').then(r => r.arrayBuffer()));  return new Proxy({}, {    get(_, methodName) {      return (...args) => new Promise((resolve, reject) => {        const poll = () => {          if (!wasmReady) { setTimeout(poll, 10); return; }          window[methodName](...args, (err, ...result) => {            if (err) reject(err); else resolve(result);          });        };        poll();      });    }  });})();

// Every POST request to SetupVPN servers goes through po().async function po(endpoint, params, { signal, baselink, requestUrl, timeout, defaults } = {}) {  const key = generateRandomKey();          // go(): 3-8 random alphanumeric chars  const headers = buildAuthHeader(key);     // mo(): {Content-Type, Authorization: Basic}  const requestOptions = { method: 'POST', headers };  const defaultParams = defaults ? defaults : await getOsDefaults(); // vo()  const mergedParams = { ...params, ...defaultParams };  requestOptions.body = encodeBody(mergedParams, key); // bo(): url-encode -> XOR -> base64  const controller = new AbortController();  requestOptions.signal = controller.signal;  const timer = setTimeout(() => controller.abort(), timeout);  const response = await fetch(requestUrl || (baselink + endpoint), requestOptions);  clearTimeout(timer);  return response;}// XOR cipher (Eo)function xorCipher(text, key) {  const t = text.split('');  const k = key.split('');  for (let i = 0; i < t.length; i++)    t[i] = String.fromCharCode(t[i].charCodeAt(0) ^ k[i % k.length].charCodeAt(0));  return t.join('');}function encodeBody(params, key) {  const urlEncoded = Object.keys(params)    .map(k => encodeURIComponent(k) + '=' + encodeURIComponent(params[k]))    .join('&');  return btoa(xorCipher(urlEncoded, key));}function decodeResponse(body, key) {  return xorCipher(decodeURIComponent(escape(atob(body))), key);}

// Eo(text, key) — character-level XOR cipher with a repeating key.function xorCipher(text, key) { const textChars = text.split(''); const keyChars = key.split(''); for (let i = 0; i < textChars.length; i++) { textChars[i] = String.fromCharCode( textChars[i].charCodeAt(0) ^ keyChars[i % keyChars.length].charCodeAt(0) ); } return textChars.join('');}// go() — generates a random 3-65 char alphanumeric key (3-8 when used in mo())function generateKey(length) { const chars = 'ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789'; return Array.from({ length }, () => chars[Math.floor(Math.random() * chars.length)]).join('');}// mo(key) — builds request headers; the XOR key goes in Authorization: Basicfunction buildHeaders(key) { const suffix = generateKey(Math.round(3 + 5 * Math.random())); return { 'Content-Type': 'text/plain', 'Authorization': 'Basic ' + btoa(key + ':' + suffix) };}// bo(params, key) — encodes the request bodyfunction encodeBody(params, key) { const urlEncoded = Object.keys(params) .filter(k => Object.prototype.hasOwnProperty.call(params, k)) .map(k => encodeURIComponent(k) + '=' + encodeURIComponent(params[k])) .join('&'); return btoa(xorCipher(urlEncoded, key));}// wo(body, key) — decodes a response bodyfunction decodeBody(encodedBody, key) { return xorCipher(decodeURIComponent(escape(atob(encodedBody))), key);}