Security and permissions
Crawlmend is designed so that the only way it changes your site is a pull request you choose to merge. This page states plainly what access it asks for.
GitHub
Crawlmend connects as a GitHub App. You choose which repositories to install it on, and it can reach only those, with only the permissions the app declares: read and write on repository contents and pull requests, and read-only on checks, commit statuses and metadata. Crawlmend uses them to list the repositories you installed it on, read files, create a branch, commit, and open a draft pull request, to read CI results on that pull request, and to close it if you ask it to. It does not merge pull requests and it does not push to your default branch.
Write access to contents is what lets Crawlmend create branches and commits. Turning on branch protection for your default branch is a good extra safeguard. You can change which repositories the app can reach, or uninstall it, at any time from GitHub.
Google Search Console
Crawlmend requests the read-only Search Console scope. It can read performance data for properties you can access; it cannot change anything in Search Console.
How tokens are stored
GitHub and Google access tokens are encrypted at rest with AES-256-GCM and used only for the API calls described above. GitHub access tokens expire after 8 hours and are refreshed automatically. Passwords are stored as salted hashes, never in plain text.
How fixes are sandboxed
Verification runs in a throwaway clone with a scrubbed environment (none of Crawlmend's own secrets) and with dependency install scripts disabled. The crawler refuses private and internal network addresses, so a crawl cannot be pointed at infrastructure behind your firewall or ours.
Revoking access
Disconnect GitHub or Search Console under Settings, Integrations. You can also uninstall the Crawlmend GitHub App or revoke its authorisation in your GitHub settings under Applications, or remove Crawlmend from your Google account's third-party access page, at any time.