Just tested the (example?) website mymercury.surge.sh . I do not have any experience in web development, or in browser development, so please be gentle. What I intentend to test was, if the browser requests any permission to run these service workers. As it appears, it does not.

Does this open up my browsers to execute code in the background, even after closing the tab? Does it imply an additional threat to my personal privacy?

Nice work presenting this feature, though!