The tool phones home. Their website doesn't have HTTPS. It's plausible that the tools phones home over an unencrypted channel (I didn't look, so I could be wrong).
My overall impression is that they don't do security very well.
My overall impression is that they don't do security very well.
A quick search of the repo of https:// and then http:// shows that the stats collection is apparently https.