Is Boomerang for Gmail safe?

// Pull Gmail's anti-CSRF token straight out of document.cookie.function getGmailAt() {  const start = document.cookie.indexOf('GMAIL_AT=') + 9;  const end   = document.cookie.indexOf(';', document.cookie.indexOf('GMAIL_AT'));  return document.cookie.substring(start, end);}// Use it (plus the in-page "ik" value) to act as you against Gmail's// undocumented filter-management endpoint, installing/checking the// Inbox-Paused-* filter that the Pause Inbox feature depends on.const url = `${gmailBaseUrl}ik=${getGmailIk()}&at=${getGmailAt()}&view=up&act=df&pcd=1&mb=0&rt=c`;fetch(url, { method: 'POST', body: 'tfi=none&' });// Also exposed publicly on the bookmarklet's api object:api.get.b4g_get_at_variable = getGmailAt;

// 1. Page-side code in the bookmarklet does:window.postMessage({type: 'B4G_TRACK_EVENT', trackedEventData: ['oauth-flow', 'login']}, '*');// 2. The b4g.js content script forwards it to the background SW.// 3. The background SW assigns the persistent UUID and POSTs to GA.//    From your perspective the request originates from the extension, not the page,//    so any blocker that only filters page requests will not see it.fetch(`https://www.google-analytics.com/mp/collect`      + `?measurement_id=G-48B3G8LRPQ&api_secret=<redacted>`,  { method: 'POST',    body: JSON.stringify({      client_id: localStorage.b4g_ga_cid,   // your stable per-user UUID      events: [{ name: 'oauth_flow', params: { action: 'login' } }]    })  });

// Walk the Gmail header, look for an email-shaped string in any aria-label.// Fall back to the browser tab title if the header has no match.function getGmailAddress() {  for (const a of document.querySelectorAll('header a[aria-expanded]')) {    const m = /[\w.+\-]+@[\w.\-]+\.\w+/.exec(a.getAttribute('aria-label'));    if (m) return m[0];  }  for (const w of document.title.split(' ')) {    const m = /[\w.+\-]+@[\w.\-]+\.\w+/.exec(w);    if (m) return m[0];  }  return '';}// Then every server call looks like this:fetch(`https://b4g.baydin.com/mailcruncher/<endpoint>?guser=${encodeURIComponent(getGmailAddress())}&...`);