Aren't extension written in Javascript? Then the source is always visible to users.