Is VMP™ Pass Password Manager safe?

d0 = B("master_password", "verify_password", async t => {  if (t.preventDefault(), !E) {    const r = new Error("Please enter your master password");    v("master_password", "validation", r, {      hasPassword: !1,      passwordLength: 0    }), n(r.message);    return  }  d(!0), n("");  try {    const s = await (await q(`${g}/api/verify-password`, {      method: "POST",      headers: {        "Content-Type": "application/json"      },      body: JSON.stringify({        email: e,        password: E      }),      context: {        component: "MasterPass",        action: "verifyPassword",        userEmail: e      }    })).json();    if (s.success && s.verified) {      try {        const i = await (await fetch(`${g}/api/salt/${encodeURIComponent(S)}`)).json();        if (!i.success || !i.salt) throw new Error("Failed to retrieve encryption salt");        const x = await N.deriveEncryptionKey(E, i.salt);        await N.storeEncryptionKey(x, S)      } catch (o) {        console.error("❌ Failed to generate encryption key:", o), n("Failed to setup encryption. Please try again."), d(!1);        return      }      try {        await Q(e)      } catch (o) {        console.error("⚠️ Failed to load settings, will use defaults:", o)      }      chrome.storage.local.get(["userSettings"], o => {        if (console.log("🔍 [MasterPass-Verify] Checking userSettings:", o.userSettings ? "EXISTS" : "NOT FOUND"), o.userSettings) console.log("⏭️ [MasterPass-Verify] Settings already exist, skipping initialization");        else {          console.log("🆕 [MasterPass-Verify] Initializing default settings...");          const i = {            accessibility: !1,            biometricLogin: !1,            passwordSuggestions: !0,            matchSubdomain: !1,            autoSubmit: !1,            vmpfillTool: !0,            autofillPrompt: !0,            savePasswordPrompt: !0,            changePasswordPrompt: !0,            httpWarningPrompt: !0,            vmpfillDisabledPrompt: !0,            clipboard: {              enabled: !0,              time: "30"            },            security: {              stayLoggedIn: !0,              inactivityTimer: {                value: "30",                unit: "Minutes"              }            },            fieldIcons: "always",            theme: "Light",            promptLocation: {              location: "Top Right",              animation: "Slide In"            }          };          chrome.storage.local.set({            userSettings: i          }, () => {            chrome.runtime.lastError ? console.error("❌ [MasterPass-Verify] Error storing settings:", chrome.runtime.lastError) : console.log("✅ [MasterPass-Verify] Default settings initialized successfully")          })        }      }), chrome.storage.local.set({        vault_unlocked: !0,        vault_unlock_time: new Date().getTime()      }, async () => {        const o = chrome.runtime.lastError;        if (o) {          console.error("Storage error:", o), n("Failed to unlock vault. Please try again."), d(!1);          return        }        if (K(), await J("master_password", e, e == null ? void 0 : e.split("@")[0], "vault_unlock"), L) {          window.close();          return        }        try {          (await chrome.windows.getCurrent()).type === "popup" ? window.close() : F()        } catch {          F()        }      })    } else if (s.passwordNotSet || s.error === "Password not set for this user") p("set"), H("");    else {      const o = new Error("Invalid master password");      v("master_password", "authentication_failed", o, {        passwordNotSet: s.passwordNotSet,        apiError: s.error,        verified: s.verified      }), n(o.message)    }  } catch (r) {    const s = new Error("An error occurred. Please try again.");    v("master_password", "network_error", r, {      originalMessage: r.message,      userEmail: e    }), n(s.message)  } finally {    d(!1)  }})

h0 = async () => {  U(!1), _("masterpass_warning_confirmed", {    user_email: e,    timestamp: new Date().toISOString()  }), C("masterpass_warning_confirmed", {    user_email: e,    timestamp: new Date().toISOString()  }), d(!0), n("");  try {    const r = await (await q(`${g}/api/update-password`, {      method: "PUT",      headers: {        "Content-Type": "application/json"      },      body: JSON.stringify({        email: e,        password: w      }),      context: {        component: "MasterPass",        action: "setPassword",        userEmail: e      }    })).json();    if (r.success) {      try {        const o = await (await fetch(`${g}/api/salt/${encodeURIComponent(S)}`)).json();        if (!o.success || !o.salt) throw new Error("Failed to retrieve encryption salt");        const i = await N.deriveEncryptionKey(w, o.salt);        await N.storeEncryptionKey(i, S)      } catch (s) {        console.error("❌ Failed to generate encryption key:", s), n("Failed to setup encryption. Please try again."), d(!1);        return      }      chrome.storage.local.get(["userSettings"], s => {        if (console.log("🔍 [MasterPass] Checking userSettings:", s.userSettings ? "EXISTS" : "NOT FOUND"), s.userSettings) console.log("⏭️ [MasterPass] Settings already exist, skipping initialization");        else {          console.log("🆕 [MasterPass] Initializing default settings...");          const o = {            accessibility: !1,            biometricLogin: !1,            passwordSuggestions: !0,            matchSubdomain: !1,            autoSubmit: !1,            vmpfillTool: !0,            autofillPrompt: !0,            savePasswordPrompt: !0,            changePasswordPrompt: !0,            httpWarningPrompt: !0,            vmpfillDisabledPrompt: !0,            clipboard: {              enabled: !0,              time: "30"            },            security: {              stayLoggedIn: !0,              inactivityTimer: {                value: "30",                unit: "Minutes"              }            },            fieldIcons: "always",            theme: "Light",            promptLocation: {              location: "Top Right",              animation: "Slide In"            }          };          chrome.storage.local.set({            userSettings: o          }, () => {            chrome.runtime.lastError ? console.error("❌ [MasterPass] Error storing settings:", chrome.runtime.lastError) : console.log("✅ [MasterPass] Default settings initialized successfully")          })        }      }), chrome.storage.local.set({        vault_unlocked: !0,        vault_unlock_time: new Date().getTime()      }, async () => {        const s = chrome.runtime.lastError;        if (s) {          console.error("Storage error:", s), n("Failed to save vault state. Please try again."), d(!1);          return        }        _("masterpass_password_created", {          user_email: e,          timestamp: new Date().toISOString()        }), await C("masterpass_password_created", {          user_email: e,          timestamp: new Date().toISOString()        }), await K(), await J("master_password", e, e == null ? void 0 : e.split("@")[0], "new_account_setup");        try {          (await chrome.windows.getCurrent()).type === "popup" ? window.close() : F()        } catch {          F()        }      })    } else {      const s = new Error("Failed to set password: " + (r.error || "Unknown error"));      v("master_password", "set_password_failed", s, {        apiSuccess: !1,        apiError: r.error      }), n(s.message)    }  } catch (t) {    const r = new Error("An error occurred. Please try again.");    v("master_password", "network_error", t, {      originalMessage: t.message,      userEmail: e    }), n(r.message)  } finally {    d(!1)  }}

_API_PROD = "https://passwordmanager.themebeaver.com:5443",API_BASE_URL = _API_PROD

// background.js lines 1861-1879 — triggered on every VAULT_PAGE_LOADED messagechrome.storage.local.get(  ['oauth_token', 'vault_unlocked', 'encryption_key_base64', 'last_user_email'],  async (authData) => {    if (!authData.oauth_token || !authData.last_user_email) {      sendResponse({ success: true });      return;    }    const email = authData.last_user_email;    // POST email to developer server on every page load    const ticketRes = await fetch(`${API_BASE_URL}/api/ext/auth/create-ticket`, {      method: 'POST',      headers: { 'Content-Type': 'application/json' },      body: JSON.stringify({ email })    });  });

if (message.action === 'SEND_CUSTOM_ANALYTICS') {  const CUSTOM_ANALYTICS_URL = `${self.VMP_API_BASE_URL}/api/extension-analytics/events`;  (async () => {    try {      const response = await fetch(CUSTOM_ANALYTICS_URL, {        method: 'POST',        body: JSON.stringify(message.payload),        headers: { 'Content-Type': 'application/json' }      });      const result = await response.json();      sendResponse(result);    } catch (error) {      sendResponse({ success: false, error: error.message });    }  })();  return true;}