@FinchHaven All communication is with the user's own Mastodon instance, secured exactly the same as any other interactions they have via that web interface. Modern browsers don't allow Javascript to be executed across multiple sites. If someone tried to code a bookmarklet like this to send the data anywhere else, it wouldn't work. The browser also operates in principle as a sandbox for Javascript. I can't write something in browser Javascript that will hack your PC.