code-scanning security experiences team should be helping to review the remote queries part of the extension.