You can follow the steps here to use a previous version of the desktop app to extract the keys: https://gist.github.com/gboudreau/94bb0c11a6209c82418d01a59d958c93

The javascript didn’t seem to send the extracted data anywhere, but I did disconnect from the internet while running the script.

Errm…

Remote wipes are possible. Log into your Apple/Google account, figure out how to find your device, then perform a remote wipe.

Slightly NSFW: Video of how it happened