Quello requests that you sign a hiveconnect contract with your active key, but as far as I can tell it doesn't acutally need anything more than posting permissions.
This seems like a major security flaw! Can anyone explain to me why Quello needs active permissions?
You can log in with your private posting key you don't need to use your active key. In terms of your Quello, it doesn't store or have access to your keys.
I guess it needs Active permissions for the first time you login, to provide posting authority.