Not the developer, but I've made extensions – there is a sandbox in the form of CSP, but if an external server is included in the policy, there are no restrictions.