Is Boomerang for Gmail safe?

// Pull Gmail's anti-CSRF token straight out of document.cookie.
function getGmailAt() {
  const start = document.cookie.indexOf('GMAIL_AT=') + 9;
  const end   = document.cookie.indexOf(';', document.cookie.indexOf('GMAIL_AT'));
  return document.cookie.substring(start, end);
}

// Use it (plus the in-page "ik" value) to act as you against Gmail's
// undocumented filter-management endpoint, installing/checking the
// Inbox-Paused-* filter that the Pause Inbox feature depends on.
const url = `${gmailBaseUrl}ik=${getGmailIk()}&at=${getGmailAt()}&view=up&act=df&pcd=1&mb=0&rt=c`;
fetch(url, { method: 'POST', body: 'tfi=none&' });

// Also exposed publicly on the bookmarklet's api object:
api.get.b4g_get_at_variable = getGmailAt;

// 1. Page-side code in the bookmarklet does:
window.postMessage({type: 'B4G_TRACK_EVENT', trackedEventData: ['oauth-flow', 'login']}, '*');

// 2. The b4g.js content script forwards it to the background SW.
// 3. The background SW assigns the persistent UUID and POSTs to GA.
//    From your perspective the request originates from the extension, not the page,
//    so any blocker that only filters page requests will not see it.
fetch(`https://www.google-analytics.com/mp/collect`
      + `?measurement_id=G-48B3G8LRPQ&api_secret=<redacted>`,
  { method: 'POST',
    body: JSON.stringify({
      client_id: localStorage.b4g_ga_cid,   // your stable per-user UUID
      events: [{ name: 'oauth_flow', params: { action: 'login' } }]
    })
  });

// Walk the Gmail header, look for an email-shaped string in any aria-label.
// Fall back to the browser tab title if the header has no match.
function getGmailAddress() {
  for (const a of document.querySelectorAll('header a[aria-expanded]')) {
    const m = /[\w.+\-]+@[\w.\-]+\.\w+/.exec(a.getAttribute('aria-label'));
    if (m) return m[0];
  }
  for (const w of document.title.split(' ')) {
    const m = /[\w.+\-]+@[\w.\-]+\.\w+/.exec(w);
    if (m) return m[0];
  }
  return '';
}

// Then every server call looks like this:
fetch(`https://b4g.baydin.com/mailcruncher/<endpoint>?guser=${encodeURIComponent(getGmailAddress())}&...`);