Is Web Guardian: Phishing & Malware Protection safe?

// uploadSessions -- background.js, function bound as api.uploadSessions.
// Called every ~5 minutes by the upload scheduler (uploadIntervalInMs: 3e5
// == 300000ms, background.js:19063), batching whatever sessions/page views
// queued locally since the last run.
async function uploadSessions(params) {
  if (!params.appId.trim()) throw new Error("Missing required parameter 'appId'");
  if (!params.installId.trim()) throw new Error("Missing required parameter 'installId'");

  const ua = parseUserAgent(navigator?.userAgent);
  await panelApiClient.request(`/v1/web/upload`, {
    method: "POST",
    retry: 0,
    body: {
      app_id: params.appId,
      install_id: params.installId,     // persistent per-install identifier
      time_zone: getTimeZone(),
      device_name: normalizeBrowserName(ua.browser?.name),
      device_type: ua.os.name,
      birth_year: params.birthYear,      // optional, collected during onboarding
      websites: params.websites,         // { hostname: { sessions: [{duration,timestamp}] } }
      diff_private_websites: params.diffPrivateWebsites,
    },
  });
}
// baseURL for this client is set to https://webguardian.st-panel-api.com
// (background.js:19023). A sibling function uploadPageViews posts the same
// shape to /v1/page_views/upload with referrer/UTM fields added per path.

// welcome/App.vue (compiled) -- the onboarding screen's data-sharing checkbox.
setup() {
  // Vue ref backing the checkbox. Starts checked (true) before any user
  // interaction; a stored value only overwrites it later if one already
  // exists in chrome.storage.local from a previous run.
  const dataCollectionEnabled = ref(true);

  onMounted(async () => {
    const stored = (await storage.local.get("dataCollectionEnabled"))["dataCollectionEnabled"];
    if (typeof stored === "boolean") dataCollectionEnabled.value = stored;
  });

  // Only called when the user finishes the welcome flow (Sign in or
  // Continue without signing in); writes whatever the checkbox currently
  // holds, which is `true` unless the user unchecked it first.
  async function persistDataCollectionConsent() {
    await storage.local.set("dataCollectionEnabled", dataCollectionEnabled.value);
  }
}

// Template: a plain <input type="checkbox"> two-way-bound to that ref, with
// no default `checked=false` override.
<input id="welcome-data-sharing" type="checkbox"
       v-model="dataCollectionEnabled" />

// pd(container, searchUrl, onAdFound) -- content-scripts/usage-helper.js.
// Runs against document.body on www.walmart.com search-results pages.
function findWalmartSponsoredAds(container, searchUrl, onAdFound) {
  const searchInput = container.querySelector('input[name="q"]');
  const found = [];
  const timestamp = Math.round(Date.now() / MS_PER_SEC);

  container.querySelectorAll('div[data-item-id], li[data-item-id]').forEach((card) => {
    if (!card?.textContent?.includes("Sponsored")) return; // only sponsored cards

    const titleEl = card.querySelector('[data-automation-id="product-title"]');
    const priceEl = card.querySelector('div[data-automation-id="product-price"]');
    let price = Array.from(priceEl?.querySelectorAll("span") || [])
      .find((s) => s.textContent?.includes("current price"))
      ?.textContent?.trim();
    // strip "current price " / "Now " / "Was " label prefixes
    for (const prefix of ["current price ", "Now ", "Was "]) {
      if (price?.startsWith(prefix)) price = price.replace(prefix, "").split(",")[0].trim();
    }

    const brand = titleEl?.parentElement?.previousElementSibling
      ?.querySelector("div.mv1")?.textContent?.trim();
    const title = titleEl?.textContent?.trim();

    const ad = {
      title: brand && title && !title.includes(brand) ? `${brand} ${title}` : title || "",
      size: priceEl?.querySelector("div:last-child")?.textContent || "",
      price,
      timestamp,
      store: "",
      search_url: searchUrl,
      search_term: searchInput?.value || "",   // your typed search term
    };
    if (ad.title) { found.push(ad); onAdFound?.(ad, card); }
  });
  return found;
}

// Vu(config) -- registers one retailer's poll loop; called once per site
// (walmart/target/instacart) when the current page URL matches config.url.
function registerAdFinderLoop(config) {
  const currentUrl = window.location.href;
  if (!currentUrl.includes(config.url)) return;
  markUrlAsCaptured(currentUrl);

  const alreadyUploaded = [];
  const inFlight = new Set();

  setInterval(async () => {
    let ads = config.finder(document.body, currentUrl, config.onAdFound, config.instacartSelectors);
    ads = ads.filter((ad) => !alreadyUploaded.includes(ad.title) && !inFlight.has(ad.title));
    ads.forEach((ad) => inFlight.add(ad.title));
    try {
      await uploadNewAds(config, ads);
      ads.forEach((ad) => alreadyUploaded.push(ad.title));
    } catch {} finally {
      ads.forEach((ad) => inFlight.delete(ad.title));
    }
  }, config.loadDelay || 3000);      // default: every 3 seconds
}

// uploadNewAds -- forwards the batch to the background service worker's
// panel-api client, which POSTs to /v1/desktop/retail/{website}.
async function uploadNewAds(config, ads) {
  if (ads.length === 0) return;
  await config.api.uploadRetailAds({
    appId: config.appId,
    installId: await config.installId,
    website: config.website,
    ads,
  });
}

// performLogin -- background.js. Opens Google's OAuth consent screen and
// pulls the authorization code back out of the redirect.
function performLogin(env) {
  return async () => {
    const redirectUri = env.browser.identity.getRedirectURL();
    const authUrl = buildAuthUrl({
      clientId: env.clientId,
      redirectUri,
      scopes: env.scopes,   // ["https://www.googleapis.com/auth/gmail.readonly"]
    });
    const responseUrl = await env.browser.identity.launchWebAuthFlow({
      url: authUrl,
      interactive: true,
    });
    if (!responseUrl) throw new Error("No response from auth flow");
    const params = new URL(responseUrl).searchParams;
    if (params.get("error")) throw new Error(params.get("error"));
    const code = params.get("code");
    if (!code) throw new Error("No authorization code in response");
    return { code, redirectUri };
  };
}

const GOOGLE_CLIENT_ID = "812707853907-9o271c7fbg18t067pdt8eodp5noed3tt.apps.googleusercontent.com";

const authSession = createAuthSession({
  storage: chromeStorageBackedStore,   // keys: wg_auth_session, wg_auth_tokens
  installId: getInstallId(),
  config: { app: "phone-guardian", platform: "web-extension", clientId: `${runtime.id}/${version}` },
  performLogin: performLogin({
    browser: chrome,
    clientId: GOOGLE_CLIENT_ID,
    scopes: ["https://www.googleapis.com/auth/gmail.readonly"],
  }),
});

// Every request through this wrapper gets the signed-in session's Google
// access token attached as a Bearer header, refreshing it once on a 401.
async function authenticatedFetch(request, init) {
  await authSession.restoreSession();
  const attach = async (token) => {
    const headers = new Headers(init?.headers);
    headers.set("Authorization", `Bearer ${token}`);
    return fetch(request, { ...init, headers });
  };
  let token = authSession.getState().tokens?.accessToken
    ?? (await authSession.refresh())?.accessToken;
  if (!token) throw new Error("not_signed_in");
  const response = await attach(token);
  if (response.status !== 401) return response;
  const refreshed = await authSession.refresh();
  if (!refreshed?.accessToken) throw new Error("session_expired");
  return attach(refreshed.accessToken);
}

// Registers authenticatedFetch as the HTTP client for the purchases API.
registerApiClient({
  app: "phone-guardian",
  platform: "web-extension",
  clientId: `${runtime.id}/${version}`,
  baseUrl: "https://purchases.stayfreeapps.com",
  fetch: authenticatedFetch,
});