Security
Permissions, architecture, safeguards, and responsible disclosure.
Single purpose: help users compare and investigate their own Google Search Console properties inside Search Console.
Architecture
GSC Pulse is a Manifest V3 extension. Privileged API calls run in the service worker, the product interface is packaged with the extension, and the content script integrates the entry point into Search Console.
Permissions
| Permission | Purpose |
|---|---|
identity | Request a Google OAuth token through Chrome Identity. |
storage | Store selected properties, settings, tags, notes, and scan cache locally. |
tabs | Open user-requested pages, Google results, and native Search Console reports. |
scripting | Support the extension's user-facing integration inside Search Console. |
www.googleapis.com | Read Search Console data through Google APIs. |
search.google.com | Display and operate the user-facing interface inside Search Console. |
Safeguards
- Read-only Search Console OAuth scope
- No remotely hosted executable code
- Manifest V3 content security policy
- External URL protocol validation
- Extension message sender validation
- Local cache limits for detailed data
- No advertising or data broker integrations
What the extension cannot do
It cannot edit a website, change Search Console settings, submit a sitemap, alter indexing, or guarantee rankings.
Responsible disclosure
Report a security issue privately to behlul@behlul.com. Include reproduction steps and avoid accessing data that is not yours.
Security contact
The machine-readable security contact is available at /.well-known/security.txt.