# Security

How Querymemo keeps your Search Console data and your account safe, and how to report a problem. Updated 2026-10-28.

## Is Querymemo safe to connect to Search Console?

Querymemo asks Google only for read-only access (`webmasters.readonly`), and its code refuses any request except four read calls before the request is sent, so it can't change anything in Search Console. Your Search Console data goes from Google to your computer and stays in the memory of the Querymemo process. querymemo.com stores your Google account ID, email, plan and the hostnames on your plan, and no Google tokens. Your AI CLI sends tool answers to its own model provider, as it does for any tool you run.

## Where your data is

| Data | Where it lives |
|---|---|
| Search Console rows, URL Inspection results, sitemaps | Only in the memory of the Querymemo process on your computer, while it runs |
| Google refresh token | Your system keychain (macOS Keychain, Windows Credential Manager, Linux Secret Service) |
| Google account ID, email, plan, the hostnames on your plan | Querymemo's account database (Cloudflare D1) |

## What we do

- **Read-only by scope.** The CLI asks Google only for `webmasters.readonly`, plus `openid` and `email`. Google lists that Search Console scope as non-sensitive, and it cannot change anything in Search Console.
- **Read-only in code.** The CLI's Google client allows four calls: the property list, search analytics, sitemaps and URL Inspection. Any other method or URL throws before a request is sent. A test covers it.
- **No tokens on our server.** The CLI proves who you are with a Google ID token that expires within an hour. Our server checks Google's signature, the issuer, the audience and the expiry, and stores none of it.
- **The account page.** A signed, HttpOnly, Secure session cookie and CSRF tokens on every form. The site picker's read-only Google token lives only in that page and is revoked as soon as your property list loads. Pages send a strict Content-Security-Policy, `frame-ancestors 'none'`, HSTS and `nosniff`.
- **Small surface.** No third-party scripts, no ads, no analytics cookies. The site is server-rendered HTML from a Cloudflare Worker.

## Reporting a vulnerability

Email [hello@querymemo.com](mailto:hello@querymemo.com) with "Security" in the subject. Include what you found and how to reproduce it. We reply within 2 business days and tell you when it's fixed. Please don't access other people's data or disrupt the service while testing. Our [security.txt](https://querymemo.com/.well-known/security.txt) has the same contact.

## Removing access

- `npx querymemo logout` revokes the Google token and removes it from your keychain.
- [myaccount.google.com/permissions](https://myaccount.google.com/permissions) removes Querymemo's access at Google.
- [querymemo.com/account](https://querymemo.com/account) deletes your account and its sites.