I’ve been using it since v1, it’s extremely configurable, very very snappy and doesn’t suffer from the common AI-problems, that seems to be forced into searches everywhere these days.
(EDIT: it’s a Spotlight replacement)
The extensions themselves are manually reviewed before being made available, but are - or were at least then - otherwise given free reign over the host system and even inherit the accessibility permissions (aka MacOS "godmode" for apps) that Raycast requires to function. To make this whole thing even more questionable, extensions are automatically and silently updated in the background, without a way for the user to disable this.
Makes you wonder in what other parts of this closed source app secure practices might have also taken a backseat.
Long story short: Very helpful tool, but their extensions architecture is quite insecure.