What about the data security, is it sending code to any servers or it works on client side?

Makes same-origin requests to github's frontend to fetch info about line counts(line count figures are only sometimes loaded into app state) - that's the only network calls it makes.