This extension uses innerHTML for rendering UI components. All content
inserted via innerHTML is generated entirely from internal state and
hardcoded strings — no user input or external data is ever inserted
directly into innerHTML. The only dynamic values injected are:
- Numbers (totalCount, dates)
- Strings from Supabase (habit titles) which are text-only display names

No external URLs, scripts, or untrusted content are ever rendered.
The extension has no remote code execution. All logic is in newtab.js
which is a local file bundled with the extension.