If it's not hashed on the front end in javascript, they're sending the plain text secret with the data to the backend. If they run the hash on the backend, there's a period of time where the writers have the plain text secret and can log it.

Furthermore, ip addresses, tripcodes, and more are just database records. The owner of a site can insert whatever they want into the database and viola, it shows up on the site.

This is like Mike Lindell claiming the ip addresses... like for fuck sake someone explain a VPN to him haha.