can you configure an extension to only work on NS domains at least? I thought by default many of them have permission to read all data on all web sites, so not just NS. Talk about risky, no?