Quello requests that you sign a hiveconnect contract with your active key, but as far as I can tell it doesn't acutally need anything more than posting permissions.

This seems like a major security flaw! Can anyone explain to me why Quello needs active permissions?