From the article >The tool is built entirely on Cloudflare Workers, and all sanitization is done client-side which means Cloudflare never sees the full content

From the article >The tool is built entirely on Cloudflare Workers, and all sanitization is done client-side which means Cloudflare never sees the full contents of the session token.