Is Yandex Access safe?

// DIRECT_CHECK_TIMEOUT = 20000 ms (20 seconds)
// config.directCheckUrls is populated from 'direct_check_urls' in the remote JSON config.
// If the field is absent or empty, the probe cycle is skipped entirely.
class DirectCheckController {
  static async runChecks(config) {
    const urls = config.directCheckUrls;
    if (!urls || !urls.length) {
      return []; // No probing if the remote config omits the field.
    }
    // Probe all listed URLs in parallel.
    const results = await Promise.all(urls.map(DirectCheckController.runCheck));
    // Ship all results to Yandex telemetry in a single call.
    await Statistic.directCheckResults(results);
    return results;
  }

  static async runCheck(url) {
    const start = window.performance.now();
    try {
      const result = await sendWebRequest({ url, method: 'GET', timeout: 20000 });
      return {
        url,
        state: 'fetch-success',
        time: performance.now() - start,   // milliseconds
        code: result.code,                 // HTTP status code
        contentLength: typeof result.data === 'string' ? result.data.length : -1
      };
    } catch (error) {
      if (error instanceof WebRequestTimeout) {
        return { url, state: 'fetch-timeout', time: performance.now() - start };
      } else if (error instanceof WebRequestHttpError) {
        return {
          url, state: 'fetch-http-error',
          time: performance.now() - start,
          code: error.code,
          contentLength: typeof error.response === 'string' ? error.response.length : -1
        };
      }
      // Network error (e.g. host unreachable)
      return { url, state: 'fetch-error', time: performance.now() - start };
    }
  }
}

class Statistic {
  // Constructs and fires a no-cors GET to the Yandex /clck/click telemetry endpoint.
  // credentials:include means browser cookies for yandex.ru are attached if present.
  static async send(message) {
    const vars = message.additionalVars || [];
    const url =
      'https://yandex.ru/clck/click/dtype=stred/pid=457/cid=73589' +
      `/path=${message.event}` +
      `/vars=${vars.map(([k, v]) => `-${encodeURIComponent(k)}=${encodeURIComponent(v)}`).join(',')}` +
      `/cts=${message.timestamp}` +
      '/*';
    await window.fetch(url, { mode: 'no-cors', credentials: 'include' });
  }

  // Called by DirectCheckController.runChecks() after all probes complete.
  // Serialises the full probe result array as JSON and enqueues it for dispatch.
  static async directCheckResults(results) {
    await this.pushMessageAndSendQueue(
      'direct-check-results',       // becomes /path=direct-check-results in the URL
      [['results', JSON.stringify(results)]]  // becomes /vars=-results=<url-encoded JSON>
    );
  }
}