I think it is quite safe because it uses steemconnect which was designed for creating secure steem based apps in development, as far as I know it means the key never leaves your computer, and talking with the developer he has said his server cannot access the key and does not try, he values safety above features actually because some things got set aside simply because they require the key to be on his server and he wants to avoid any security risks. On top of that, the posting key can't access any of your funds, so there is less incentive for someone to try stealing it.

I have been using it a lot and feel like it's safe to do.