So, if it works on the browser, the key does not leave the computer, right?
The purpose of having to click the reward button is to merge the rewards in one single transaction, reducing the blockchain size and making the network more stable.
As far as I know the network can easily manage all the transactions, but it may be necessary in the future to increase the bot delay or even shut it down. A feature that monitors the network and disable the bot if problems in the network are detected would be cool. Unfortunately I do not know how this can be done.
The key isn't recorded anywhere in the computer, but just input box in browser.
The Steem.js API is used to monitor and claim.
Cool, this is an important security feature.