The scanner mistook a keyword used for reading streaming replies from an AI service for a suspicious link type. The code only reads text coming back from the AI service the user chose; it does not open any link or contact anything unexpected.
Technical evidence
Scanner reason: JavaScript analysis matched static JavaScript security signal javascript.xray.shady-link. The match applies to this repository.
Contextual assessment: The flagged line is part of a server-sent-event (SSE) stream reader for the extension's own OpenAI-compatible backend mode. It checks whether a received stream line begins with the literal prefix used by the SSE wire format to carry JSON payload data; that prefix text is what the static scanner matched, likely confusing it with a data: URL scheme. The code performs no navigation, no script or resource loading, and no network destination from this line. All network destinations in the file are either the user-configured Ollama or OpenAI-compatible endpoints, the host's Connection Manager service, or the host's own generation API, each matching the project's stated purpose of routing side-thread questions to a selectable backend.
The scanner flagged a plain web address without encryption. It is simply the default address of a locally installed AI server running on the user's own machine, which the project openly documents and the user can change. Nothing sensitive is sent there by default.
Technical evidence
Scanner reason: JavaScript analysis matched static JavaScript security signal javascript.xray.shady-link. The match applies to this repository.
Contextual assessment: The flagged line is a default configuration value pointing at the standard local port of a self-hosted Ollama model server, using plain HTTP because the service runs on the same machine. This default is fully disclosed in the project documentation as the direct-connection mode's endpoint, is user-editable, and the request path that consumes it only sends the assembled side-thread prompt to that endpoint. No credentials are attached to Ollama requests in the supplied code, and no other destination receives this value. A non-TLS local loopback address for a local inference server is ordinary and proportionate to the stated purpose.