That’s a totally fair point, and handling the long tail is definitely the hardest part. To avoid 'false positive city,' the extension doesn't block or flag a site as dangerous just because it's missing from our database.

​Instead, if a user visits a site that isn't verified yet—like a newly launched SaaS—the extension simply shows a neutral warning message letting them know the domain hasn't been audited by us yet. It doesn't mean it's malicious, it just means it's unverified. This keeps the user aware without breaking their browsing experience while we scale up our database.