[tough]

you could give paying customers access to the code to run themselves (not open source)

if that works for you/your privacy-aware customer they can inspect the code/build it/ run their own version

[djyde]

Actually, the nice thing about chrome extensions is that users can view all requests made by content_script and background script through devtool. This is much more intuitive than checking the code.