am I correct in feeling wary of using this from a security standpoint

I don’t really think you have to be worried about security. Without an official API I’d be more worried about stability and potential data loss due to e.g. bugs in the encryption implementation or unexpected API changes though.

this is asking you to put in your Proton username and password and 2FA and it gets stored as a token in the config file.

As far as I can tell it’s just using your username and password to obtain an access token just like any other Proton Drive client, including the offical one, would have to do.

I tested it a bit a few months back, when the trial was still a bit more generous. Results are generally good (often better, but sometimes worse than Google’s) and the custom filtering/weighting of search results is really cool. That said, for me the difference isn’t nearly large enough to justify the price compared to just continuing to use Google with uBlock Origin. Especially considering a big part of their costs are third party API integrations for AI summarization, weather, maps etc (IIRC from some of their comments on HN), most of which I don’t actually need or want. Maybe if I could pay like $3-5 without having to worry about going over some search limit and suddenly having to pay per search…