Connector security
Last updated: September 6, 2026
The short version
Connectors read metrics; they never write. There is no code path in StackMemo that modifies anything on a provider — it cannot push to your repos, charge your customers, change DNS, trigger deploys or send email. You create each API key yourself with the smallest scope the provider offers (read-only wherever supported), so the provider enforces that limit independently of us. Keys are encrypted at rest and deleted when you disconnect.
How access works
StackMemo doesn't use OAuth "connect" buttons that request broad grants. Instead, every connector walks you through creating a key in the provider's own dashboard — where you choose exactly what it can see — and you paste it in. The setup guide for each provider recommends the minimum scope, listed below. You can revoke a key at any time from the provider's side and StackMemo simply stops syncing.
What each connector reads
GitHub
- Auth:
- Personal access token you create
- Key scope:
- Read-only. A fine-grained token with Metadata: Read on just the repo you track is enough.
- Reads:
- Repository metadata for the repo you pick: stars, forks, watchers, open issues.
Stripe
- Auth:
- Restricted API key you create
- Key scope:
- Read-only restricted key: Products → Read, Subscriptions → Read, Charges → Read (charges only if you enable the 30-day revenue KPI).
- Reads:
- Your product list (to pick what to track), active subscriptions (MRR and subscriber count), and paid charges from the last 30 days (30-day revenue).
- Note:
- The 30-day revenue number is account-wide — Stripe charges don't reference products.
Neon
- Auth:
- API key + organization ID
- Key scope:
- Neon API keys are not scopeable, so the key can read your whole org. StackMemo only calls the project list and consumption endpoints.
- Reads:
- Project list and usage metrics: compute hours, storage, data transfer.
Cloudflare
- Auth:
- API token you create
- Key scope:
- Zone: Read and Zone.Analytics: Read, limited to the zones you want to track.
- Reads:
- Zone list and 24-hour traffic analytics: requests, page views, bandwidth.
Koyeb
- Auth:
- API token you create
- Key scope:
- Koyeb tokens are account-wide (no scoping offered). StackMemo only calls read endpoints for apps, services and deployments.
- Reads:
- Service and deployment info: deployment count (30d), time since last deploy, service health.
Google Search Console
- Auth:
- Service account JSON key
- Key scope:
- Only the read-only scope (webmasters.readonly) is ever requested when exchanging the key for a token.
- Reads:
- Search performance for your property: clicks and impressions.
Resend
- Auth:
- API key
- Key scope:
- Needs a Full-access key — Resend's sending-only keys can't read audiences. This is the one connector whose key could do more than read; StackMemo still only calls read endpoints.
- Reads:
- Audience contact counts, subscribed contact counts, broadcasts sent (30d).
Custom HTTP
- Auth:
- Your own endpoint (+ optional header)
- Key scope:
- Whatever your endpoint exposes — you control it entirely.
- Reads:
- A GET request to a JSON endpoint you provide. Public internet only — requests to private or internal addresses are blocked.
How credentials are stored
- Keys are encrypted at rest in Postgres with pgcrypto's symmetric encryption (
pgp_sym_encrypt). The encryption key lives in an environment variable held separately from our authentication secrets. - After you save a key, it is never echoed back to the browser — secret fields render write-only.
- Decrypted values exist only in memory during a sync; they are never logged.
- Deleting a connector deletes its encrypted credentials row. Deleting your account deletes everything.
Sync schedule and failure handling
- Connectors sync once per hour, once on each deploy, and whenever you press "Sync all" on a project.
- A failing connector is marked with an error status and the error message is shown in the UI — it never blocks your other connectors, which keep syncing normally.
- Partial results are kept: if a provider returns some KPIs but not others (a plan-restricted endpoint, say), what was fetched is stored and the rest surfaces as a warning on the connector.
Live connectors vs. tracked services
Two different things share your stack list, and we label them accordingly:
- Live connectors — the eight above. They hold a credential and sync KPIs automatically.
- Manually tracked services — anything else (Vercel, Plausible, AWS, Supabase and 40+ more in the quick-add catalog, or any custom entry). You record the cost, plan and renewal date yourself; no credentials involved, nothing is accessed.
- Coming soon — Plausible, Vercel and Google Analytics connectors are on the roadmap. Until a connector ships, those providers are manual-tracking only.
Questions
Something unclear, or want to audit deeper before pasting a key? Get in touch — happy to walk through exactly which endpoints a connector calls.