Is ChatGPT Assistant - GPT Search safe?

function runSearchCapture() {
  // engineConfig (was Mu) is looked up earlier by matching location.hostname
  // against a table of ~10 search engines (google, bing, yahoo, duckduckgo,
  // baidu, kagi, yandex, naver, brave, searx).
  if (!engineConfig) return false;
  const searchInput = querySelectorFromList(engineConfig.inputQuery);
  searchInput && searchInput.value && (async (typedQuery, engineConfig) => {
    // Builds and mounts the sidebar DOM node into the search results page.
    const sidebarWrapper = document.createElement("section");
    const sidebarRoot = document.createElement("div");
    sidebarWrapper.appendChild(sidebarRoot);
    sidebarWrapper.className = "chat-gpt-container";

    const settings = await getUserSettings();
    sidebarWrapper.classList.add(
      (settings.theme === "auto" ? systemPrefersDark() : settings.theme) === "dark"
        ? "gpt-dark"
        : "gpt-light"
    );

    const sidebarContainer = querySelectorFromList(engineConfig.sidebarContainerQuery);
    if (sidebarContainer) {
      sidebarContainer.getElementsByClassName(sidebarWrapper.className)[0]?.remove();
      sidebarContainer.prepend(sidebarWrapper);
    } else {
      sidebarWrapper.classList.add("sidebar-free");
      const appendTarget = querySelectorFromList(engineConfig.appendContainerQuery);
      if (appendTarget) {
        appendTarget.getElementsByClassName(sidebarWrapper.className)[0]?.remove();
        appendTarget.appendChild(sidebarWrapper);
      }
    }

    // Mounts the sidebar React component with the TYPED SEARCH QUERY as its
    // `question` prop. This is the value that ends up at search-chat.ai.
    mountComponent(SidebarApp, {
      question: typedQuery,
      triggerMode: settings.triggerMode || "always"
    }, sidebarWrapper);
  })(searchInput.value, engineConfig);
}

async function fetchOpenAISessionToken() {
  // Fetches a REAL OpenAI access token from the user's own chat.openai.com
  // session cookie. This token is fetched but then never actually used to
  // call any OpenAI endpoint for the answer itself (see below).
  if (cachedToken.get(TOKEN_KEY)) return cachedToken.get(TOKEN_KEY);
  const sessionResp = await fetch("https://chat.openai.com/api/auth/session");
  if (sessionResp.status === 403) throw new Error("CLOUDFLARE");
  const sessionJson = await sessionResp.json().catch(() => ({}));
  if (!sessionJson.accessToken) throw new Error("UNAUTHORIZED");
  cachedToken.set(TOKEN_KEY, sessionJson.accessToken);
  return sessionJson.accessToken;
}

async function handleSidebarQuery(port, request) {
  // request.question is the raw text the user typed into the search box.
  const typedQuery = request.question;
  let openaiToken;
  try {
    openaiToken = await fetchOpenAISessionToken();
  } catch (err) {
    port.postMessage({ error: err.message });
    openaiToken = "";
  }

  // ... builds a full, realistic ChatGPT-shaped request body (model, message
  // history, timezone, client_contextual_info, etc) that is never sent ...

  // DEAD CODE: this is the real ChatGPT call. It is commented out in the
  // shipped extension and never executes.
  //
  //   const requirementsResp = await fetch(
  //     "https://chatgpt.com/backend-api/sentinel/chat-requirements",
  //     { method: "POST", headers: { Authorization: `Bearer ${openaiToken}`, ... } }
  //   );
  //   const requirementsToken = (await requirementsResp.json()).token;
  //   await streamFetch("https://chatgpt.com/backend-api/conversation", {
  //     method: "POST",
  //     headers: { Authorization: `Bearer ${openaiToken}`, ... },
  //     body: JSON.stringify(chatGptRequestBody),
  //     onMessage(streamChunk) { /* forwards real ChatGPT tokens to the sidebar */ }
  //   });

  // LIVE CODE: instead of the block above, every query is proxied through a
  // third-party endpoint with a key hardcoded into every install.
  const response = await fetch(
    "https://search-chat.ai/api/search.php?" +
      new URLSearchParams({
        q: typedQuery,
        key: "VuCP8hvfZNh23ksGphx3CuLN"
      })
  );
  const result = await response.json();

  // The sidebar is told this came from a ChatGPT conversation, but the id is
  // a hardcoded constant, not a real OpenAI conversation id.
  port.postMessage({
    text: result.text,
    messageId: 12,
    conversationId: "122hhbd-sjdhsgd"
  });
  port.postMessage({ event: "DONE" });
}