Is ModHeader - Modify HTTP headers safe?

// Destination, empty allow-list, and salt are module-level constants.
const UPLOAD_URL = "https://api.stanfordstudies.com/app/log";
const ALLOW_LIST  = [];            // ships EMPTY -> path is dormant
const SALT        = "mod\u76d0header"; // \u76d0 = Chinese character for "salt"

// Runs on every navigation, once per tab load.
async function onNavigation(tabId, changeInfo, tab) {
  try {
    const browser = detectBrowser();            // 'chrome' | 'edge' | 'firefox' | 'other'
    // Guard: only proceed if this browser is on the allow-list AND the tab is loading.
    // ALLOW_LIST is [], so indexOf(...) === -1 is ALWAYS true -> always returns here.
    if (ALLOW_LIST.indexOf(browser) === -1 || changeInfo.status !== "loading") return;
    const url = changeInfo.url || tab.url;
    if (!url) return;
    await countDomain(url);
  } catch (e) {}
}
chrome.tabs.onUpdated.addListener(onNavigation);

// Encrypts the visited domain and bumps its counter in IndexedDB.
async function countDomain(url) {
  const domain = new URL(url).host;             // e.g. 'mail.google.com'
  if (domain === globalThis.lastChangeDomain) return; // de-dupe repeat hits
  globalThis.lastChangeDomain = domain;

  const { settingsDB, domainDB, fp, aesIv } = await openStores();
  const encDomain = await AesGcm.encrypt(KEY, domain, aesIv); // key is built in
  const current   = await domainDB.get(encDomain, 0);
  await domainDB.put(encDomain, current + 1);   // encrypted-domain -> visit count
  await maybeUpload(domainDB, settingsDB, aesIv);
}

// The AES-256-GCM key is hardcoded and imported once at startup.
KEY = await AesGcm.importKeyFromBase64("aWfU3yG_wksZaQdSnxPJBOId0cAN8KK/UIlZbli7-bE");

// Sends the encrypted counter blob to the upload endpoint.
async function upload(encBlob, retries = 2) {
  const body = { data: encBlob, fp: globalThis.fp, browser: detectBrowser() };
  try { return await postJson(UPLOAD_URL, body, retries); }
  catch (e) { return false; }
}

// Runs after each counter bump; uploads at most ~once/day within a per-install window.
async function maybeUpload(domainDB, settingsDB, aesIv) {
  const reason = await dueForUpload(domainDB, settingsDB); // day-boundary / 1000-cap check
  if (!reason || (reason !== "uploadToNow" && !await withinDailyJitterWindow())) return;

  const map = {};
  await domainDB.cursor((k, v) => { map[k] = v; });        // { encDomain: count, ... }
  const encBlob = await AesGcm.encrypt(KEY, JSON.stringify(map), aesIv);
  const ok = await upload(encBlob, 2);
  if (ok) { await settingsDB.put("lastUploadDate", new Date()); await domainDB.clear(); }
}