Is Web Guardian: Phishing & Malware Protection safe?

// uploadSessions -- background.js, function bound as api.uploadSessions.// Called every ~5 minutes by the upload scheduler (uploadIntervalInMs: 3e5// == 300000ms, background.js:19063), batching whatever sessions/page views// queued locally since the last run.async function uploadSessions(params) {  if (!params.appId.trim()) throw new Error("Missing required parameter 'appId'");  if (!params.installId.trim()) throw new Error("Missing required parameter 'installId'");  const ua = parseUserAgent(navigator?.userAgent);  await panelApiClient.request(`/v1/web/upload`, {    method: "POST",    retry: 0,    body: {      app_id: params.appId,      install_id: params.installId,     // persistent per-install identifier      time_zone: getTimeZone(),      device_name: normalizeBrowserName(ua.browser?.name),      device_type: ua.os.name,      birth_year: params.birthYear,      // optional, collected during onboarding      websites: params.websites,         // { hostname: { sessions: [{duration,timestamp}] } }      diff_private_websites: params.diffPrivateWebsites,    },  });}// baseURL for this client is set to https://webguardian.st-panel-api.com// (background.js:19023). A sibling function uploadPageViews posts the same// shape to /v1/page_views/upload with referrer/UTM fields added per path.

// welcome/App.vue (compiled) -- the onboarding screen's data-sharing checkbox.setup() {  // Vue ref backing the checkbox. Starts checked (true) before any user  // interaction; a stored value only overwrites it later if one already  // exists in chrome.storage.local from a previous run.  const dataCollectionEnabled = ref(true);  onMounted(async () => {    const stored = (await storage.local.get("dataCollectionEnabled"))["dataCollectionEnabled"];    if (typeof stored === "boolean") dataCollectionEnabled.value = stored;  });  // Only called when the user finishes the welcome flow (Sign in or  // Continue without signing in); writes whatever the checkbox currently  // holds, which is `true` unless the user unchecked it first.  async function persistDataCollectionConsent() {    await storage.local.set("dataCollectionEnabled", dataCollectionEnabled.value);  }}// Template: a plain <input type="checkbox"> two-way-bound to that ref, with// no default `checked=false` override.<input id="welcome-data-sharing" type="checkbox"       v-model="dataCollectionEnabled" />

// pd(container, searchUrl, onAdFound) -- content-scripts/usage-helper.js.// Runs against document.body on www.walmart.com search-results pages.function findWalmartSponsoredAds(container, searchUrl, onAdFound) {  const searchInput = container.querySelector('input[name="q"]');  const found = [];  const timestamp = Math.round(Date.now() / MS_PER_SEC);  container.querySelectorAll('div[data-item-id], li[data-item-id]').forEach((card) => {    if (!card?.textContent?.includes("Sponsored")) return; // only sponsored cards    const titleEl = card.querySelector('[data-automation-id="product-title"]');    const priceEl = card.querySelector('div[data-automation-id="product-price"]');    let price = Array.from(priceEl?.querySelectorAll("span") || [])      .find((s) => s.textContent?.includes("current price"))      ?.textContent?.trim();    // strip "current price " / "Now " / "Was " label prefixes    for (const prefix of ["current price ", "Now ", "Was "]) {      if (price?.startsWith(prefix)) price = price.replace(prefix, "").split(",")[0].trim();    }    const brand = titleEl?.parentElement?.previousElementSibling      ?.querySelector("div.mv1")?.textContent?.trim();    const title = titleEl?.textContent?.trim();    const ad = {      title: brand && title && !title.includes(brand) ? `${brand} ${title}` : title || "",      size: priceEl?.querySelector("div:last-child")?.textContent || "",      price,      timestamp,      store: "",      search_url: searchUrl,      search_term: searchInput?.value || "",   // your typed search term    };    if (ad.title) { found.push(ad); onAdFound?.(ad, card); }  });  return found;}

// Vu(config) -- registers one retailer's poll loop; called once per site// (walmart/target/instacart) when the current page URL matches config.url.function registerAdFinderLoop(config) {  const currentUrl = window.location.href;  if (!currentUrl.includes(config.url)) return;  markUrlAsCaptured(currentUrl);  const alreadyUploaded = [];  const inFlight = new Set();  setInterval(async () => {    let ads = config.finder(document.body, currentUrl, config.onAdFound, config.instacartSelectors);    ads = ads.filter((ad) => !alreadyUploaded.includes(ad.title) && !inFlight.has(ad.title));    ads.forEach((ad) => inFlight.add(ad.title));    try {      await uploadNewAds(config, ads);      ads.forEach((ad) => alreadyUploaded.push(ad.title));    } catch {} finally {      ads.forEach((ad) => inFlight.delete(ad.title));    }  }, config.loadDelay || 3000);      // default: every 3 seconds}// uploadNewAds -- forwards the batch to the background service worker's// panel-api client, which POSTs to /v1/desktop/retail/{website}.async function uploadNewAds(config, ads) {  if (ads.length === 0) return;  await config.api.uploadRetailAds({    appId: config.appId,    installId: await config.installId,    website: config.website,    ads,  });}

// performLogin -- background.js. Opens Google's OAuth consent screen and// pulls the authorization code back out of the redirect.function performLogin(env) {  return async () => {    const redirectUri = env.browser.identity.getRedirectURL();    const authUrl = buildAuthUrl({      clientId: env.clientId,      redirectUri,      scopes: env.scopes,   // ["https://www.googleapis.com/auth/gmail.readonly"]    });    const responseUrl = await env.browser.identity.launchWebAuthFlow({      url: authUrl,      interactive: true,    });    if (!responseUrl) throw new Error("No response from auth flow");    const params = new URL(responseUrl).searchParams;    if (params.get("error")) throw new Error(params.get("error"));    const code = params.get("code");    if (!code) throw new Error("No authorization code in response");    return { code, redirectUri };  };}

const GOOGLE_CLIENT_ID = "812707853907-9o271c7fbg18t067pdt8eodp5noed3tt.apps.googleusercontent.com";const authSession = createAuthSession({  storage: chromeStorageBackedStore,   // keys: wg_auth_session, wg_auth_tokens  installId: getInstallId(),  config: { app: "phone-guardian", platform: "web-extension", clientId: `${runtime.id}/${version}` },  performLogin: performLogin({    browser: chrome,    clientId: GOOGLE_CLIENT_ID,    scopes: ["https://www.googleapis.com/auth/gmail.readonly"],  }),});// Every request through this wrapper gets the signed-in session's Google// access token attached as a Bearer header, refreshing it once on a 401.async function authenticatedFetch(request, init) {  await authSession.restoreSession();  const attach = async (token) => {    const headers = new Headers(init?.headers);    headers.set("Authorization", `Bearer ${token}`);    return fetch(request, { ...init, headers });  };  let token = authSession.getState().tokens?.accessToken    ?? (await authSession.refresh())?.accessToken;  if (!token) throw new Error("not_signed_in");  const response = await attach(token);  if (response.status !== 401) return response;  const refreshed = await authSession.refresh();  if (!refreshed?.accessToken) throw new Error("session_expired");  return attach(refreshed.accessToken);}// Registers authenticatedFetch as the HTTP client for the purchases API.registerApiClient({  app: "phone-guardian",  platform: "web-extension",  clientId: `${runtime.id}/${version}`,  baseUrl: "https://purchases.stayfreeapps.com",  fetch: authenticatedFetch,});