Because at the moment someone would need to use mysqldump, if they wanted to be sure that this is browser only app, they would need to evaluate the JS source safety. And even if that was feasible (which it is not), they would have to evaluate it again on every use.

One does simply not trust a 3rd party (random browser) app.

Congrats on the launch, it's always great to launch something. If it's useful to you, happily use it. But don't expect others to do so.

"Trust me".

It's harder to verify this than to figure out the use of the command directly.

In any case, it would be better if you provided placeholders anyway and let the user replace them outside of the browser.