Is Dupe.com: Find similar products for less safe?

const TINYBIRD_ENDPOINT = "https://api.us-east.tinybird.co/v0/events?name=extension_events",  TINYBIRD_TOKEN = "<redacted>",           // hardcoded bearer token, identical for every install  FEATURE_FLAG_KEY = "extension-tinybird-events",  FLUSH_INTERVAL_MS = 1e4,                  // 10 seconds  FLUSH_BATCH_SIZE = 20,  BUFFER_STORAGE_KEY = "dupe:event-buffer",  MAX_BUFFERED = 500;class EventEmitter {  constructor(token) {    this.queue = [];    this.enabled = false;    this.flushTimer = null;    this.token = token || TINYBIRD_TOKEN;  }  async init() {    if (!this.token) return;    try {      this.enabled = !!(await FeatureFlags.getFeatureFlag(FEATURE_FLAG_KEY, 9e5)); // 900s cache, remote-controlled    } catch { this.enabled = false; }    if (!this.enabled) return;               // no-op entirely when the remote flag is off    await this.restoreBuffer();    this.flushTimer = setInterval(() => this.flush(), FLUSH_INTERVAL_MS);  }  async track(event) {    if (!this.enabled) return;    const enveloped = await this.envelope(event);    this.queue.push(enveloped);    if (this.queue.length >= FLUSH_BATCH_SIZE) this.flush();  }  async flush() {    if (this.queue.length === 0) return;    const batch = this.queue.splice(0);    const ndjsonBody = batch.map(e => JSON.stringify(e)).join("\n");    try {      const res = await fetch(TINYBIRD_ENDPOINT, {        method: "POST",        headers: { Authorization: `Bearer ${this.token}`, "Content-Type": "application/x-ndjson" },        body: ndjsonBody      });      if (!res.ok) throw new Error(`TinyBird HTTP ${res.status}`);    } catch { await this.bufferEvents(batch); }  }  async envelope(event) {    const session = (await chrome.storage.session.get("dupe:shopping-session"))["dupe:shopping-session"];    const sessionId = session?.startedAt ? `s_${session.startedAt}` : this.fallbackSessionId;    const user = await Auth.getActiveUser();    const tempUserId = await Auth.getTempUserId();    return {      ...event,      timestamp: new Date().toISOString(),      session_id: sessionId,      user_id: user?.uid || null,            // your signed-in Dupe account ID, when logged in      temp_user_id: tempUserId,              // persistent pseudo-anonymous ID otherwise      extension_version: chrome.runtime.getManifest().version,      browser: "chrome"    };  }}const tinybirdEmitter = new EventEmitter();

// Fired from the product-detail-page detector on every PDP view:tinybirdEmitter.track({  event_type: "pdp_view",  shop_key: shopKey,  url: stripTrackingParams(pageUrl),  image_url: metadata?.imageUrl,  title: metadata?.title,  price: metadata?.price,  currency: metadata?.currency,  brand: metadata?.brand,  category: metadata?.category,  selected_color: metadata?.selectedColor,  selected_size: metadata?.selectedSize,  gender: metadata?.gender,  seller: metadata?.seller,  sku: metadata?.sku,  material: metadata?.material,  shipping: metadata?.shipping,  returns: metadata?.returns,  warranty: metadata?.warranty,  has_color: Array.isArray(metadata?.colors) && metadata.colors.length > 0 ? 1 : 0,  has_size: Array.isArray(metadata?.sizes) && metadata.sizes.length > 0 ? 1 : 0,  has_specs: metadata?.specs ? 1 : 0,  specs_json: metadata?.specs ? JSON.stringify(metadata.specs) : null,  has_rating: metadata?.rating != null ? 1 : 0,  rating: metadata?.rating,  review_count: metadata?.reviewCount,  review_summary: metadata?.reviewSummary,  review_snippets_json: Array.isArray(metadata?.reviewSnippets) && metadata.reviewSnippets.length > 0    ? JSON.stringify(metadata.reviewSnippets.slice(0, 5))    : null});// Internal message handler — any component in the extension can trigger// a Tinybird event by sending a TRACK_TINYBIRD message, with no field// validation applied before it's enveloped and queued:onMessage(Messages.TRACK_TINYBIRD, async ({ data }) => {  tinybirdEmitter.track(data);  return { status: "ok" };});

const { isPdp: i, pageChanged: r } = pv(),  n = async s => {    const c = `https://dupe.com/${s}`;    await yi(vi.OPEN_TAB, { url: c })  };return Ra.useEffect(() => {  typeof i > "u" || (async () => {    const s = of(window.location.href),      c = await Zh(),                // extractMetadata(): title, price, currency, imageUrl, brand, description...      d = !!ov.get("stand-down");    Y0.track(Wt.ExtensionPageViewed, {      medium: "extension",      shopKey: s,                    // per-domain key derived from the URL      url: window.location.href,     // the FULL current page address      isPdp: i,                      // true only on a detected product page      metadata: c,                   // OG title/price/currency/image when present      standDown: d    }, { skipPosthog: !0 })          // routed to GA only, not to PostHog  })()}, [i, r]), Ra.useEffect(() => {  // ...separate listener for the "dupe this" context-menu action, omitted...}, []), null

const EVENT_BATCH_KEY = "dupe:eventBatchViews",  BATCH_SIZE = 3,  GA_API_SECRET = "<redacted>",  GA_MEASUREMENT_ID = "G-CZFTQBRF2Q",  GA_ENDPOINT = "https://www.google-analytics.com/mp/collect",  normalizeName = e => e.toLowerCase().replace(/\s/g, "_"),  loadBatch = async () => await storage.get(EVENT_BATCH_KEY) || [],  saveBatch = async e => { await storage.set(EVENT_BATCH_KEY, e) },  clearBatch = async () => await storage.remove(EVENT_BATCH_KEY),  postToGA = async (userId, events, clientId = "") => await fetch(    `${GA_ENDPOINT}?measurement_id=${GA_MEASUREMENT_ID}&api_secret=${GA_API_SECRET}`,    {      method: "POST",      body: JSON.stringify({        client_id: clientId || userId,        user_id: userId,        events: events.map(n => ({ name: normalizeName(n.name), params: { ...n.params } }))      })    }  );function registerGaTrackHandler() {  onMessage(GA_TRACK, async ({ data: e }) => {    const { name: t, userId: r, properties: n, clientId: s } = e;    try {      const params = { ...n };      const event = { userId: r || "anonymous", name: t, params };      if (t === Events.ExtensionPageViewed) {        const batch = await loadBatch() || [];        batch.push(event);        if (batch.length > 100) batch.splice(0, batch.length - 100);        await saveBatch(batch);        if (batch.length >= BATCH_SIZE) {          // flush once 3 page views have queued          const res = await postToGA(r || "", batch, s);          if (res.ok) await clearBatch();          return res.statusText || {};        }        return {};      }      return (await postToGA(r || "", [event], s)).statusText || {};    } catch (err) {      return { status: "error", statusMessage: "An error occurred while trying to track the event" };    }  })}