Hmm.

If we pretend that there are no vulnerabilities today, then the mind turns to what will change in the future.

I tolerate js in the Bitwarden extension because it's necessary, funded, supported and necessary. But Retriever sounds to me like a project that would do better to minimise surface area.