Is WhatRuns safe?

// Fires every time any page finishes loading in any tab.
browser.webRequest.onCompleted.addListener(function(details) {
  const url = normaliseURL(details.url);
  const rawHostname = extractHostname(url);   // e.g. 'gist.github.com'
  sendURLToWhatRunsServer(details.tabId, rawHostname, url);
}, {
  urls: ['http://*/*', 'https://*/*'],  // every HTTP/HTTPS URL
  types: ['main_frame']                  // top-level navigations only
});

function sendURLToWhatRunsServer(tabId, rawHostname, url) {
  // Build the payload with hostname + URL
  const payload = buildUrlPayload(url, rawHostname);
  // Attach your account email + API key if you're logged in (base64-encoded)
  const payloadWithAuth = attachCredentials(payload);
  // POST it to WhatRuns — unconditionally, on every navigation
  fetch('https://www.whatruns.com/api/v1/get_site_apps', {
    method: 'POST',
    headers: { 'Content-Type': 'application/x-www-form-urlencoded' },
    body: 'data=' + encodeURIComponent(JSON.stringify(payloadWithAuth))
  });
}

primeFlow: async function() {
  try {
    var t = {
      id: FLOW_BOOT_SIGNAL
    };
    let e = this;
    setTimeout(function() {
      e.pushRuntimeMessage(t, t => {})
    }, 2e3)
  } catch (t) {
    console.log("content [primeFlow] error: ", t)
  }
}
flushBeacon: async function() {
  try {
    const e = {
      url: window.location.href,
      title: document ? document.title : "",
      referrer: document.referrer || "",
      uuid: await this.ensureRuntimeKey(),
      plugin_version: chrome.runtime.getManifest().version
    };
    var t = {
      id: FLOW_ECHO_SIGNAL,
      data: e
    };
    this.pushRuntimeMessage(t, t => {})
  } catch (t) {
    console.log(t)
  }
}
ensureRuntimeKey: async function() {
  let t = await this.readStoreValue("wrs_session_uuid");
  if (t) return t;
  let e = this.buildRuntimeKey();
  return this.writeStoreValue("wrs_session_uuid", e), e
}
buildRuntimeKey: function() {
  const t = new Uint8Array(16);
  return crypto.getRandomValues(t), t[6] = 15 & t[6] | 64, t[8] = 63 & t[8] | 128, [...t].map((t, e) => "" + t.toString(16).padStart(2, "0")).join("")
}

forwardRuntimeEcho: async function(t) {
  try {
    await _this.makeRequest({
      type: "POST",
      url: ANALYSE_PATH,
      reqBody: t
    })
  } catch (t) {
    console.log(t)
  }
}
activateRuntimeBridge: async function(t, e) {
  BROWSER.tabs.sendMessage(e, {
    id: FLOW_PRIME_SIGNAL,
    data: {}
  }, function(t) {
    return !0
  })
}
makeRequest: async function(t) {
  let {
    type: e = "GET",
    url: a,
    headers: o = {},
    reqBody: n = {}
  } = t, s = {
    status: 599,
    msg: "Error"
  };
  try {
    "Content-Type" in o || (o["Content-Type"] = "application/json");
    let t = {
      method: e,
      body: JSON.stringify(n),
      headers: o
    };
    "GET" === e && delete t.body, await fetch(a, t).then(t => t.json()).then(t => {
      s = t
    }).catch(t => {
      console.log(t), s.msg = t
    })
  } catch (t) {
    return console.log(3), void(s.msg = t.toString())
  }
  return s
}

export const DOMAIN_NAME = "https://www.whatruns.com/";
export const CDN_DOMAIN_NAME = "https://cdn.whatruns.com/";
export const BROWSER = chrome || browser;
export const ANALYSE_APPS = "analyseApps";
export const GET_DETECTED_APPS = "getDetectedApps";
export const GET_NOTIFICATION_MESSAGE = "getNotificationMessage";
export const GET_HOST_NAME = "getHostName";
export const SET_DATA = "setData";
export const GET_DATA = "getData";
export const GET_TECHS = "get_techs";
export const GET_SITE_DATA = "get_site_data";
export const KEY_DETAILS = "keyDetails";
export const FORM = "form";
export const GET_SITE_APPS = DOMAIN_NAME + "api/v1/get_site_apps";
export const GET_SITE_APPS_BY_DATA = DOMAIN_NAME + "api/v1/get_site_apps_by_data";
export const ANALYSE_EMAILS = DOMAIN_NAME + "api/v1/analyse_emails";
export const REVIEW_FEATURE_DATA = DOMAIN_NAME + "api/v1/ext_review";
export const invalidDomains = ["localhost", "127.0.0.1", "0.0.0.0"];
export const NO_APPS_FOUND = " I feel lost, maybe there's nothing to be found ; ) ";
export const ANALYSE_PAGE = DOMAIN_NAME + "api/v1/analyse/page";
export const ANALYSE_PATH = DOMAIN_NAME + "api/v1/analyse/path";

flushBeacon: async function() {
  try {
    const e = {
      url: window.location.href,
      title: document ? document.title : "",
      referrer: document.referrer || "",
      uuid: await this.ensureRuntimeKey(),
      plugin_version: chrome.runtime.getManifest().version
    };
    var t = {
      id: FLOW_ECHO_SIGNAL,
      data: e
    };
    this.pushRuntimeMessage(t, t => {})
  } catch (t) {
    console.log(t)
  }
},
primeFlow: async function() {
  try {
    var t = {
      id: FLOW_BOOT_SIGNAL
    };
    let e = this;
    setTimeout(function() {
      e.pushRuntimeMessage(t, t => {})
    }, 2e3)
  } catch (t) {
    console.log("content [primeFlow] error: ", t)
  }
},
ensureRuntimeKey: async function() {
  let t = await this.readStoreValue("wrs_session_uuid");
  if (t) return t;
  let e = this.buildRuntimeKey();
  return this.writeStoreValue("wrs_session_uuid", e), e
},
buildRuntimeKey: function() {
  const t = new Uint8Array(16);
  return crypto.getRandomValues(t), t[6] = 15 & t[6] | 64, t[8] = 63 & t[8] | 128, [...t].map((t, e) => "" + t.toString(16).padStart(2, "0")).join("")
}