Trust center / Security

Production context without collecting everything.

FetchNode uses scoped project keys, bounded payloads and conservative generated defaults. You decide when more context is appropriate for your application.

DEFAULT

Sensitive request data stays off

Bodies, headers, IP addresses, query strings, SQL parameters and raw SQL text are disabled. Normalized query structure is enabled for N+1 detection.

ACCESS

Keys and external access are scoped

Public browser keys cannot create release markers. Private server keys can be revoked per project. Google Search Console uses read-only OAuth and encrypted credentials.

RETENTION

Raw history has a defined lifetime

Plan retention is enforced for errors, requests, product analytics, browser quality, jobs and client delivery reports. Project deletion invalidates remaining keys.

Capture matrix

What the default setup sends

SignalDefault
Exception type, message and application stack frames
On
Django route, method, timing and internal user ID
On
Environment, release and bounded breadcrumbs
On
Headers, request body, query string and IP address
Off
SQL statement text
Off
Browser analytics before consent
Off

Your coding agent gets project-scoped access.

MCP rejects public browser keys and requires a usable private server key or still-valid legacy key. A website’s key scopes its tools to that project. The local stdio configuration reads the configured key at runtime; inspect generated files before committing them.

Read tools can return stored error details, stack source lines, internal user IDs and captured request context as well as performance and aggregate search data. Issue tools can resolve, ignore or snooze an issue. An external agent provider may receive tool results; authorize only an agent you intend to give this access.

Generated capture defaults remain conservative. Fields explicitly enabled for your website can appear in its stored evidence. Revoking a key stops future authenticated calls using it; it does not remove results already received by an external agent.

Inspect agent setup and supported work →

Application controls

  • • Per-project browser and server keys.
  • • Key revocation, rotation and optional expiry.
  • • Organization and project roles for dashboard access.
  • • Read-only Google scope with OAuth state and PKCE validation.
  • • Search Console tokens encrypted with a dedicated deployment key.
  • • Bounded ingest size and per-project rate limiting.
  • • Scanner-noise filtering before visible issue alerts.

Operational controls

  • • HTTPS is required for production deployment.
  • • Stripe hosts checkout and payment-method handling.
  • • Readiness checks cover the database and configured cache.
  • • Raw telemetry is cleaned up against plan retention.
  • • Security concerns can be reported directly to the founder.

Report a security concern

Please do not include production secrets or customer data in the first message. Describe the affected surface and a safe way to reproduce the issue.

Contact the maintainer through GitHub first. Do not disclose vulnerability details in a public issue.