And whoever is running this proxy will _promise_ not to log any sensitive information (API keys not the least) or otherwise use/modify the response for their ow

And whoever is running this proxy will _promise_ not to log any sensitive information (API keys not the least) or otherwise use/modify the response for their own ends? Not to mention that the API endpoint is HTTP only, meaning everything is broadcast in the clear. Also, cross origin requests are perfectly possible without this library, it's precisely why we use JSONP and CORS. When it comes to security, this library is a collection of anti-patterns. As well as the JS anti-pattern of not overwriting native objects, such as XMLHttpRequest in this context.