Is SetupVPN - Lifetime Free VPN safe?

// UPDATE_SERVERSJSON is the Redux action type that replaces all API endpoints.
const UPDATE_SERVERSJSON = 'UPDATE_SERVERSJSON';

// Hardcoded fallback config — used only if no CDN mirror is reachable.
// In practice, getTiers() fires at startup and CDN response overwrites this immediately.
const DEFAULT_SERVER_CONFIG = {
 retcode: 200,
 data: {
 version: 4,
 update_interval_hours: 6, // server can change this
 mainbase: [ // 12 API endpoints — all fingerprinted requests go here
 'https://lllm.scanners.fun',
 'https://uabh.talked.run',
 'https://mjgu.figure.run',
 'https://xcxx.pointed.cc',
 'https://uaia.scanners.fun',
 'https://icax.figure.run',
 'https://1.foreground.work',
 'https://1.awakened.work',
 'https://1.6912044.cc',
 'https://1.default2024.uk',
 'https://1.sahi.uk',
 'https://1.area9.uk'
 ],
 tierbase: [ // 5 secondary endpoints
 'https://sxkk.pointed.cc',
 'https://api.keepthisdomain.com',
 'https://1.allnine.uk',
 'https://ksho.uk',
 'https://3245.uk'
 ],
 mirrors: [ // 7 CDN mirrors tried in order
 'https://tierbase3.fra1.cdn.digitaloceanspaces.com/tierssv.json',
 'https://tierbase4.s3.amazonaws.com/tierssv.json',
 'https://pub-8029ed10cf4e4db0b3757e6b82ef7a40.r2.dev/tierssv.json',
 'https://ams1.vultrobjects.com/tierupdate2/tierssv.json',
 'https://mirror4.es-mad-1.linodeobjects.com/tierssv.json',
 'https://raw.githubusercontent.com/the7c/update/master/master/ui/data.json',
 'https://bitbucket.org/the7c/update/raw/master/edge/pub/data.json'
 ]
 }
};

// On startup: create a repeating alarm named 'int1' tied to getTiers().
// updateIntervalTime is derived from update_interval_hours in the last fetched config.
this.updateInterval = new IntervalTimer(
 this.getTiers.bind(this),
 this.updateIntervalTime, // default 6 hours = 21600000ms; server-adjustable
 'int1' // alarm name visible in chrome.alarms
);
this.updateInterval.start();
this.getTiers(); // also fires immediately at startup

// isValidTierResponse() accepts the response only if:
// retcode === 200
// mainbase.length > 2
// tierbase.length > 2
// update_interval_hours must be integer 1 < x < 168 (1 week max)

// Loads main.wasm and wraps all exported Go functions in a Promise-based proxy.
const zi = (() => {
  let wasmReady = false;
  async function initWasm(wasmBytesPromise) {
    const go = new Go();  // Go WASM runtime helper (wasm_exec.js)
    const bytes = await wasmBytesPromise;
    const instance = await WebAssembly.instantiate(bytes, go.importObject);
    go.run(instance.instance);
    wasmReady = true;
  }
  initWasm(fetch('/main.wasm').then(r => r.arrayBuffer()));
  return new Proxy({}, {
    get(_, methodName) {
      return (...args) => new Promise((resolve, reject) => {
        const poll = () => {
          if (!wasmReady) { setTimeout(poll, 10); return; }
          window[methodName](...args, (err, ...result) => {
            if (err) reject(err); else resolve(result);
          });
        };
        poll();
      });
    }
  });
})();

// Every POST request to SetupVPN servers goes through po().
async function po(endpoint, params, { signal, baselink, requestUrl, timeout, defaults } = {}) {
  const key = generateRandomKey();          // go(): 3-8 random alphanumeric chars
  const headers = buildAuthHeader(key);     // mo(): {Content-Type, Authorization: Basic}
  const requestOptions = { method: 'POST', headers };

  const defaultParams = defaults ? defaults : await getOsDefaults(); // vo()
  const mergedParams = { ...params, ...defaultParams };

  requestOptions.body = encodeBody(mergedParams, key); // bo(): url-encode -> XOR -> base64

  const controller = new AbortController();
  requestOptions.signal = controller.signal;
  const timer = setTimeout(() => controller.abort(), timeout);

  const response = await fetch(requestUrl || (baselink + endpoint), requestOptions);
  clearTimeout(timer);
  return response;
}

// XOR cipher (Eo)
function xorCipher(text, key) {
  const t = text.split('');
  const k = key.split('');
  for (let i = 0; i < t.length; i++)
    t[i] = String.fromCharCode(t[i].charCodeAt(0) ^ k[i % k.length].charCodeAt(0));
  return t.join('');
}

function encodeBody(params, key) {
  const urlEncoded = Object.keys(params)
    .map(k => encodeURIComponent(k) + '=' + encodeURIComponent(params[k]))
    .join('&');
  return btoa(xorCipher(urlEncoded, key));
}

function decodeResponse(body, key) {
  return xorCipher(decodeURIComponent(escape(atob(body))), key);
}

// Eo(text, key) — character-level XOR cipher with a repeating key.
function xorCipher(text, key) {
 const textChars = text.split('');
 const keyChars = key.split('');
 for (let i = 0; i < textChars.length; i++) {
 textChars[i] = String.fromCharCode(
 textChars[i].charCodeAt(0) ^ keyChars[i % keyChars.length].charCodeAt(0)
 );
 }
 return textChars.join('');
}

// go() — generates a random 3-65 char alphanumeric key (3-8 when used in mo())
function generateKey(length) {
 const chars = 'ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789';
 return Array.from({ length }, () => chars[Math.floor(Math.random() * chars.length)]).join('');
}

// mo(key) — builds request headers; the XOR key goes in Authorization: Basic
function buildHeaders(key) {
 const suffix = generateKey(Math.round(3 + 5 * Math.random()));
 return {
 'Content-Type': 'text/plain',
 'Authorization': 'Basic ' + btoa(key + ':' + suffix)
 };
}

// bo(params, key) — encodes the request body
function encodeBody(params, key) {
 const urlEncoded = Object.keys(params)
 .filter(k => Object.prototype.hasOwnProperty.call(params, k))
 .map(k => encodeURIComponent(k) + '=' + encodeURIComponent(params[k]))
 .join('&');
 return btoa(xorCipher(urlEncoded, key));
}

// wo(body, key) — decodes a response body
function decodeBody(encodedBody, key) {
 return xorCipher(decodeURIComponent(escape(atob(encodedBody))), key);
}