GatekeeperAI blocks phishing / scam links and malicious QR codes. The
extension needs an API key to activate — there is no in-extension signup,
so a key is required to test any scanning behaviour.

TEST CREDENTIALS
API key: gk_181ffdf1-d48b-4459-9057-64c3ec14b95d
(No username/password and no account creation needed. Nothing else is
required — no email, no payment.)

SETUP (about 30 seconds)
1. Install the extension and click its toolbar icon.
2. The popup shows "Protection is OFF. No API key yet."
3. Paste the API key above into the key field and click Activate.
4. The popup then shows protection ON, with a "Check a link" box.

HOW TO EXERCISE THE MAIN FUNCTIONALITY
The warning page only appears for a link classified as suspicious or
phishing, so normal browsing will not show it. Two safe ways to trigger it
without visiting a real malicious site:

A) In the popup's "Check a link" box, paste:
https://login.secure.paypal.evil.com/
Expected: a SUSPICIOUS verdict (deceptive subdomain structure).
Also try http://192.168.1.1/ (raw IP address) for a second case.

B) Click a link to either URL in a normal page. The extension
interrupts navigation and shows a full-page warning with the reason,
a "Back to Safety" button, and an "I understand the risks, proceed
anyway" option. Ticking "Always allow this site" adds that host to
the user's allowed list so it is not warned about again.

WHY THE PERMISSIONS ARE NEEDED
- Host access: read the URL being navigated to, in order to classify it
before the page loads. Page content is not read or transmitted.
- declarativeNetRequest: block navigation to a flagged URL.
- storage: hold the user's API key and their allowed-sites list.

DEPENDENCIES
Requires network access to https://www.gatekeeperai.app to classify links.
Nothing is transmitted except the URL being checked.

Fixes from the QA round:

• Links added to a page after load are now marked, including links inside iframes.
• Corrected marking on legitimate links that were being flagged, and on flagged links that opened without the warning.
• The block interstitial moved out of popup.html into its own blocked.html, so the popup is no longer web-accessible.
• Clearer indication of whether protection is active during install.

What's new in 0.11.0:

• Email protection now also checks links in the quoted part of forwarded and replied emails — forwarding a dangerous message now warns you before it sends.
• New "Check a link" box in the popup: paste any link for an instant Safe / Suspicious / Danger verdict.
• The toolbar icon now adapts to light and dark browser themes.
• The popup now shows the installed version number.
• Assorted fixes and polish.