YEs, CORS is the reason for this and the code for this proxy is open source and very simple[0]. I didn't want to add disclaimers to clutter the UI nor did I wanted to build a browser extension as it would suffer from same trust issues (you still need to trust the extension developer).
For full transparency, the proxy is hosted on Zeit's `now` service and I don't even have access to logs so accidental leaks should be pretty safe.