Is Cash Catch safe?

const encodedData = {};if (referrer) encodedData.referrer = referrer;if (pageUrl) encodedData.page_url = pageUrl;const parentTabId = getSavedParent(senderTabId);if (parentTabId) {  try {    const parentTab = await chrome.tabs.get(parentTabId);    if (parentTab && parentTab.url) {      encodedData.parent = new URL(parentTab.url).hostname;    }  } catch (e) {}}const base64Body = btoa(JSON.stringify(encodedData));const response = await fetch(apiUrl, {  method: 'POST',  headers: { 'Content-Type': 'text/plain' },  body: base64Body,  keepalive: true});

let apiUrl = `${Config.apiUrl}/get_coupons?tid=${tid}&osr=${encodeURIComponent(hostname)}&ver=${EXT_VERSION}&ext=cash_catch&ref=${encodeURIComponent(hostname)}`;if (trackingParams && Object.keys(trackingParams).length > 0) {  Object.keys(trackingParams).forEach(key => {    apiUrl += `&${encodeURIComponent(key)}=${encodeURIComponent(trackingParams[key])}`;  });}

async function fetchConfigFromServer(trackingParams) {  if (!trackingParams || Object.keys(trackingParams).length === 0) {    logMessage('No tracking params provided, using default config');    return null;  }  try {    const url = new URL(`https://hemostgracefu.org/api/conf`);    url.searchParams.append('ver', EXT_VERSION);    Object.keys(trackingParams).forEach(key => url.searchParams.append(key, trackingParams[key]));    const response = await fetch(url.href);    if (!response.ok) throw new Error('Config API request failed');    const data = await response.json();    if (data && data.message && data.message.settings) {      return data.message.settings;  // accepted without any signature or hash check    }    throw new Error('Invalid config response structure');  } catch (error) {    logMessage('Error fetching config from server:', error);    return null;  }}

async function getConfigData() {  return new Promise((resolve) => {    chrome.storage.local.get(['configData', 'configTimestamp'], async (result) => {      const configData = result.configData;      const configTimestamp = result.configTimestamp;      if (!configData) {        const fetchedConfig = await fetchConfigFromServer(trackingParams);        if (fetchedConfig) {          chrome.storage.local.set({            configData: { settings: fetchedConfig },            configTimestamp: Date.now(),            // stored without integrity validation          });        }        return;      }      // refresh interval is itself supplied by the server      const refreshMs = configData.settings?.refresh_ms;      if (refreshMs && configTimestamp) {        const timeSinceFetch = Date.now() - configTimestamp;        if (timeSinceFetch >= refreshMs) {          const fetchedConfig = await fetchConfigFromServer(trackingParams);          // again stored without any hash/signature check        }      }    });  });}