---
title: "Security — GSC Pulse"
description: "Permissions, architecture, safeguards, and responsible disclosure."
canonical: "https://gscpulse.behlul.com/security/"
language: "en"
updated: "2026-08-06"
robots: "noindex, follow"
---

[Home](/)›Security

# Security

Permissions, architecture, safeguards, and responsible disclosure.

**Single purpose:** help users compare and investigate their own [Google Search Console](/glossary/google-search-console/) properties inside Search Console.

## Architecture

GSC Pulse is a Manifest V3 extension. Privileged API calls run in the service worker, the product interface is packaged with the extension, and the content script integrates the entry point into Search Console.

## Permissions

| Permission | Purpose |
| --- | --- |
| `identity` | Request a Google OAuth token through Chrome Identity. |
| `storage` | Store selected properties, settings, tags, notes, and scan cache locally. |
| `tabs` | Open user-requested pages, Google results, and native Search Console reports. |
| `scripting` | Support the extension's user-facing integration inside Search Console. |
| `www.googleapis.com` | Read Search Console data through Google APIs. |
| `search.google.com` | Display and operate the user-facing interface inside Search Console. |

## Safeguards

- Read-only Search Console OAuth scope
- No remotely hosted executable code
- Manifest V3 content security policy
- External URL protocol validation
- Extension message sender validation
- Local cache limits for detailed data
- No advertising or data broker integrations

## What the extension cannot do

It cannot edit a website, change Search Console settings, submit a sitemap, alter indexing, or guarantee rankings.

## Responsible disclosure

Report a security issue privately to [behlul@behlul.com](mailto:behlul@behlul.com?subject=GSC%20Pulse%20security). Include reproduction steps and avoid accessing data that is not yours.

## Security contact

The machine-readable security contact is available at </.well-known/security.txt>.