My god, so Slope was sending plain text private key and seed phrases to a server.
There is absolutely no acceptable design reason for that.
I expected a string appending somewhere incorrectly as a leak but this is labelled… what the hell?