Is Behavix safe?

// tn(): patches window.fetch so every outgoing request is inspected
function patchFetch() {
  const originalFetch = window.fetch;
  window.fetch = async function (...args) {
    const requestArg = args[0];
    let url, method;
    if (typeof requestArg === "string") {
      url = requestArg;
    } else if (requestArg instanceof Request) {
      url = requestArg.url;
      method = requestArg.method;
    } else if (requestArg instanceof URL) {
      url = requestArg.toString();
    }
    const response = await originalFetch.apply(this, args);
    if (!url) return response;
    const init = args[1] || {};
    const httpMethod = (init.method ?? method ?? "GET").toUpperCase();

    // findMatchingRule(): is there a server-supplied rule for this path/method?
    if (!findMatchingRule(url, httpMethod, activeConfigs)) return response;

    const responseBodyText = await response.clone().text();
    const { reqBody, reqBodyKind } = splitRequestBody(init.body);

    // buildCapturePayload(): decide (per server config) what to send
    const capture = buildCapturePayload(
      { url, method: httpMethod, reqBody, reqBodyKind, resBody: responseBodyText },
      activeConfigs,
      { pageUrl: window.location.href, configVersionHash: currentConfigHash }
    );
    if (capture) relayToBackground(capture);
    return response;
  };
}

// we(): decides WHAT gets sent, entirely from server-supplied booleans/regex
function buildCapturePayload(captured, configs, ctx) {
  const rule = findMatchingRule(captured.url, captured.method, configs);
  if (!rule) return null;

  const bodyRegex = rule.config.compiledRegex; // built from server's matcher_regex
  if (!bodyRegex || captured.resBody === null || !bodyRegex.test(captured.resBody)) {
    return null;
  }

  const hasRequestBody =
    captured.reqBodyKind === "form-ish" ||
    (captured.reqBodyKind === "string" && captured.reqBody);

  let payload;
  if (rule.config.capture_request_url === true) {
    payload = captured.url;                       // just the URL
  } else if (rule.config.capture_request_body === true && hasRequestBody) {
    // BOTH what the page posted AND what it got back
    payload = JSON.stringify({
      response: captured.resBody,
      request: extractRequestBody(captured),
    });
  } else {
    payload = captured.resBody;                    // the full response body
  }

  return {
    config_id: rule.config.id,
    config_version_hash: ctx.configVersionHash,
    payload,
    url: ctx.pageUrl,
  };
}

// registerDomPageLoad() + captureNode(): reads arbitrary page content
// picked by a server-supplied CSS selector or XPath, gated by a
// server-supplied regex over that element's own content.
async registerDomPageLoad(rule, configVersionHash) {
  const cfg = new DomPageLoadRule(rule);
  if (!pathMatches(cfg.config.path, cfg.config.path_matcher)) return;

  const findTargets = cfg.config.target_node_xpath !== undefined
    ? () => evaluateXPath(cfg.config.target_node_xpath)
    : () => {
        const nodes = document.querySelectorAll(cfg.config.css_selector);
        return nodes.length ? Array.from(nodes) : undefined;
      };

  const targets = await pollUntilFound(10, findTargets);
  targets?.forEach((node) => {
    if (node instanceof HTMLElement && contentMatchesServerRegex(node.innerHTML, cfg.config)) {
      this.captureNode(node, cfg.config, configVersionHash);
    }
  });
}

captureNode(node, config, configVersionHash) {
  if (node.textContent === null) return;
  switch (config.capture_mode) {
    case "HTML":
      this.onMatchedConfig(config.id, node.innerHTML, configVersionHash);
      break;
    case "TEXT":
      if (node.innerText !== null) {
        this.onMatchedConfig(config.id, node.innerText, configVersionHash);
      }
      break;
  }
}