Addresses feedback on PR #12 regarding the protocol-relative URL early return in isExternalUrl().

Changes

• Added comment explaining why the // check at line 366 is critical for correctness, not optimization
• Clarifies that protocol-relative URLs must be handled before reaching the URL constructor, where they could be incorrectly resolved with window.location.href as base

// Protocol-relative URLs (//example.com) are always external
// CRITICAL: This check must happen before the URL constructor call below.
// Protocol-relative URLs with window.location.href as base would be
// incorrectly resolved (e.g., "//evil.com" + "http://mysite.com" could
// resolve unexpectedly). Treating them as external upfront ensures
// correct security classification and prevents potential URL parsing issues.
if (trimmedUrl.startsWith('//')) {
  return true;
}

This prevents future maintainers from inadvertently removing or relocating the check, which would introduce security classification bugs.

💬 We'd love your input! Share your thoughts on Copilot coding agent in our 2 minute survey.