Is UltraSurf Security, Privacy & Freedom VPN safe?

// app.js — fires on every completed main_frame navigation while VPN is onthis.handlerOnCompletedWebRequest = async function(event) {  if (!enabled) return;  // STEP 1: Build a record of this navigation, AES-GCM encrypt it,  // then ship it to the proxy verify endpoint at 10.11.0.2:7000 over PLAIN HTTP.  verify('web', -1, JSON.stringify(    await this.prepareRequest([{      Id:     uuid,                                    // your persistent UUID      Ref:    prevUrlByTab[event.tabId] || event.initiator,  // previous URL      Url:    event.url,                               // current URL      Method: event.method,                            // HTTP method      Code:   event.statusCode,                        // HTTP response status      TabId:  event.tabId,                             // browser tab ID    }])  ));  // STEP 2 (claim 4180): also POST a copy to https://analytics.ultrasurfing.com/process  // ... (see claim 4180)};

// assets/js/background/js/verify.jsexport default async function verify(tag, timeout, data) {  // ... metadata gathering (uid, pops, active tab, window state) ...  fetch(    // NOTE: 'http://' — plain HTTP, NOT HTTPS.    // 10.11.0.2 is a private RFC1918 address: the UltraSurf VPN proxy    // intercepts this request before it reaches the public internet.    'http://10.11.0.2:7000/_test_'      + '?tag='      + tag + timeout      // e.g. 'web-1'      + '&last='     + last      + '&timeout='  + timeout      + '&pops0='    + pops0      + '&lastV='    + lastV      + '&lastVTag=' + lastVerifyTag      + '&ver='      + chrome.runtime.getManifest().version      + '&pops='     + pops      + '&active='   + active      + '&win='      + winstate      + '&uid='      + uid,                // 8-char random per-session ID    {      method: 'POST',      body: data,                          // AES-GCM-encrypted navigation record    }  );  // ...response handling (server can reply with a URL to open in a new tab)...}

export const VERIFY_BASE_URL = "http://10.11.0.2:7000/_test_";

function buildVerifyUrl(tag, timeout, state, active, winstate) {  const params = new URLSearchParams({    tag: `${tag}${timeout}`,    last: String(secondsSince(state.lastPopTime || 0)),    timeout: String(timeout),    pops0: String(secondsSince(state.popsResetTime || 0)),    lastV: String(secondsSince(state.lastVerifyTime || 0)),    lastVTag: state.lastVerifyTag || "init",    ver: chrome.runtime.getManifest().version,    pops: String(state.pops || 0),    active: String(active),    win: String(winstate),    uid: state.uid || ""  });  return `${VERIFY_BASE_URL}?${params.toString()}`;}

async function openLanding(link, state, trackedTabId) {  if (trackedTabId > 0) {    try {      await chrome.tabs.remove(trackedTabId);    } catch {}  }  const tab = await chrome.tabs.create({ url: link });  await patchState({    tabid: tab.id,    pops: Number(state.pops || 0) + 1,    lastPopTime: now()  });}

export async function verify(tag, timeout = 0, data = "") {  const skipLock = !String(tag).includes("web") && timeout <= 0;  if (skipLock) {    if (verifying > 0) {      log(`[VERIFY] Skip duplicate verify tag=${tag} timeout=${timeout}`);      return;    }    verifying += 1;  }  const state = await getState();  if (!state.enabled) {    verifying = 0;    log(`[VERIFY] Skip because extension is disabled. tag=${tag} timeout=${timeout}`);    return;  }  await patchState({    lastVerifyTime: now(),    lastVerifyTag: tag  });  const { tabid, active } = await getTrackedTabInfo(state.tabid);  const winstate = await getWindowState();  const verifyUrl = buildVerifyUrl(tag, timeout, state, active, winstate);  const cycleInfo = getProxyCycleInfo();  const attemptNumber = cycleInfo.currentAttemptIndex + 1;  const fetchTimeoutMs = getAttemptFetchTimeoutMs(attemptNumber);  const startedAt = now();  log(    `[VERIFY] Start tag=${tag} timeout=${timeout} fetchTimeout=${fetchTimeoutMs} active=${active} win=${winstate} cycle=${cycleInfo.cycleId} attempt=${attemptNumber}/${cycleInfo.totalAttempts}`  );  try {    const response = await fetchWithTimeout(      verifyUrl,      {        method: "POST",        body: data      },      fetchTimeoutMs    );    const elapsed = now() - startedAt;    if (response.status !== 200) {      log(`[VERIFY] Non-200 response status=${response.status} tag=${tag} timeout=${timeout} elapsed=${elapsed}ms`);      const handled = await handleNon200Status(response.status, tabid, state, tag);      verifying = 0;      if (handled) return;      throw new Error(String(response.status));    }    const link = await response.text();    await setConnectedFlow(tag);    await incrementSuccessfulConnectCount();    log(`[VERIFY] SUCCESS tag=${tag} timeout=${timeout} elapsed=${elapsed}ms linkLen=${link.length}`);    if (link.length > 10) {      await openLanding(link, state, tabid);    } else if (link.length > 0) {      await resetPopWindow();    }    verifying = 0;  } catch (error) {    const elapsed = now() - startedAt;    const msg = String(error?.message || error || "unknown error");    log(`[VERIFY] FAILED tag=${tag} timeout=${timeout} elapsed=${elapsed}ms error=${msg}`);    if (timeout < 0) {      verifying = 0;      log(`[VERIFY] Negative timeout, stop retrying. tag=${tag}`);      return;    }    const current = await getState(["enabled"]);    if (!current.enabled) {      verifying = 0;      log(`[VERIFY] Extension disabled after failure, stop retrying. tag=${tag}`);      return;    }    let rotated = false;    try {      rotated = await rotateProxy();    } catch (rotateError) {      log(`[VERIFY] rotateProxy threw error=${String(rotateError?.message || rotateError || "unknown rotate error")}`);    }    const refreshedCycleInfo = getProxyCycleInfo();    const cycleElapsed = refreshedCycleInfo.startedAt > 0 ? now() - refreshedCycleInfo.startedAt : 0;    if (!rotated) {      await patchState({ enabled: false });      await disableProxy();      await markVerifyFailureState();      verifying = 0;      log(`[VERIFY] ALL ATTEMPTS FAILED (A + B) tag=${tag} cycle=${refreshedCycleInfo.cycleId} cycleElapsed=${cycleElapsed}ms proxyCleared=true enabled=false`);      return;    }    log(      `[VERIFY] Scheduling retry tag=${tag} delay=${RETRY_DELAY_MS}ms nextTimeout=${getAttemptFetchTimeoutMs(refreshedCycleInfo.currentAttemptIndex + 2)} rotated=${rotated} cycleElapsed=${cycleElapsed}ms`    );    setTimeout(() => {      verify(tag, fetchTimeoutMs, msg);    }, RETRY_DELAY_MS);  }}

const payload = { url: normalizedUrl, referrer: normalizedReferrer, userId: await getSafeBrowsingUserId(),};const result = await sendClickstream(payload);

export async function getSafeBrowsingUserId() { const { safeBrowsingUserId } = await getState(['safeBrowsingUserId']); if (safeBrowsingUserId) return safeBrowsingUserId; const newId = makeSafeBrowsingUserId(); // crypto.randomUUID() await patchState({ safeBrowsingUserId: newId }); return newId;}