Security hints: VirusTotal reputation provider

[mortenn]

Part of #285, #249, and meta #245.

Provider

VirusTotal API v3.

Fit

Useful as a bring-your-own-key reputation/enrichment provider, but not suitable as a bundled default. The public API is heavily rate limited and must not be used in commercial products or services.

Data Sent

URL lookup/analysis workflows may send the full URL or a canonical URL identifier to VirusTotal. The UI must disclose when the full URL is submitted or queried.

API / Terms Notes

The public API requires a VirusTotal Community API key, is limited to 4 requests per minute and 500 requests per day, and is restricted from commercial products/services. Premium API use has separate licensing and quotas.

Acceptance Notes

• Disabled by default.
• User-triggered only unless a future automatic-check setting explicitly enables reputation checks.
• Bring-your-own VirusTotal API key; never bundle a shared key.
• Make public-vs-premium/API terms clear in settings text.
• Respect per-minute and daily quotas and show quota/rate-limit failures neutrally.
• Do not log URLs or API keys.
• Make clear that VirusTotal results are provider reports, not a Browser Picker safety guarantee.
• Do not automatically call this provider when a URL matches Defaults.

Out of Scope

• Bundling VirusTotal Public API use into Browser Picker defaults.
• Uploading files or using malware sample endpoints.
• RDAP or public CT history lookups.