Is Behavix safe?

// tn(): patches window.fetch so every outgoing request is inspectedfunction patchFetch() {  const originalFetch = window.fetch;  window.fetch = async function (...args) {    const requestArg = args[0];    let url, method;    if (typeof requestArg === "string") {      url = requestArg;    } else if (requestArg instanceof Request) {      url = requestArg.url;      method = requestArg.method;    } else if (requestArg instanceof URL) {      url = requestArg.toString();    }    const response = await originalFetch.apply(this, args);    if (!url) return response;    const init = args[1] || {};    const httpMethod = (init.method ?? method ?? "GET").toUpperCase();    // findMatchingRule(): is there a server-supplied rule for this path/method?    if (!findMatchingRule(url, httpMethod, activeConfigs)) return response;    const responseBodyText = await response.clone().text();    const { reqBody, reqBodyKind } = splitRequestBody(init.body);    // buildCapturePayload(): decide (per server config) what to send    const capture = buildCapturePayload(      { url, method: httpMethod, reqBody, reqBodyKind, resBody: responseBodyText },      activeConfigs,      { pageUrl: window.location.href, configVersionHash: currentConfigHash }    );    if (capture) relayToBackground(capture);    return response;  };}

// we(): decides WHAT gets sent, entirely from server-supplied booleans/regexfunction buildCapturePayload(captured, configs, ctx) {  const rule = findMatchingRule(captured.url, captured.method, configs);  if (!rule) return null;  const bodyRegex = rule.config.compiledRegex; // built from server's matcher_regex  if (!bodyRegex || captured.resBody === null || !bodyRegex.test(captured.resBody)) {    return null;  }  const hasRequestBody =    captured.reqBodyKind === "form-ish" ||    (captured.reqBodyKind === "string" && captured.reqBody);  let payload;  if (rule.config.capture_request_url === true) {    payload = captured.url;                       // just the URL  } else if (rule.config.capture_request_body === true && hasRequestBody) {    // BOTH what the page posted AND what it got back    payload = JSON.stringify({      response: captured.resBody,      request: extractRequestBody(captured),    });  } else {    payload = captured.resBody;                    // the full response body  }  return {    config_id: rule.config.id,    config_version_hash: ctx.configVersionHash,    payload,    url: ctx.pageUrl,  };}

// registerDomPageLoad() + captureNode(): reads arbitrary page content// picked by a server-supplied CSS selector or XPath, gated by a// server-supplied regex over that element's own content.async registerDomPageLoad(rule, configVersionHash) {  const cfg = new DomPageLoadRule(rule);  if (!pathMatches(cfg.config.path, cfg.config.path_matcher)) return;  const findTargets = cfg.config.target_node_xpath !== undefined    ? () => evaluateXPath(cfg.config.target_node_xpath)    : () => {        const nodes = document.querySelectorAll(cfg.config.css_selector);        return nodes.length ? Array.from(nodes) : undefined;      };  const targets = await pollUntilFound(10, findTargets);  targets?.forEach((node) => {    if (node instanceof HTMLElement && contentMatchesServerRegex(node.innerHTML, cfg.config)) {      this.captureNode(node, cfg.config, configVersionHash);    }  });}captureNode(node, config, configVersionHash) {  if (node.textContent === null) return;  switch (config.capture_mode) {    case "HTML":      this.onMatchedConfig(config.id, node.innerHTML, configVersionHash);      break;    case "TEXT":      if (node.innerText !== null) {        this.onMatchedConfig(config.id, node.innerText, configVersionHash);      }      break;  }}