[QUESTION] I know this may be too dumb/noob to ask but please bear with me

[captainfuckface]

Huge thank you to the developer for this awesome project. I'm not a 'techy' person by any means but thanks to you I'm able to run a Whoogle instance. I used Heroku to deploy it and it made me wonder if they (Heroku) have ways to see/store logs or any other data when I do web searches. Thank you in advance for helping this noob out

[benbusby]

Hi @captainfuckface (ha) sorry for the delay in responding to this. Heroku instances do store logs, and can actually be viewed by the creator of the app either through the command line or through the Heroku dashboard (under More -> View logs on the application page). That being said, searches sent via POST request will not directly expose the search term in the log, and element paths are encrypted using a randomly generated (per search) key.

Here's a snippet of the log from a Heroku instance I just spun up, showing an example POST request log as well as the encrypted element requests:

2021-01-07T22:49:40.298869+00:00 heroku[router]: at=info method=POST path="/search" host=<my heroku app> request_id=85cff5b5-fe9f-451f-81b6-179b64378f2e dyno=web.1 connect=1ms service=801ms status=200 bytes=35797 protocol=https
2021-01-07T22:49:40.665367+00:00 heroku[router]: at=info method=GET path="/element?url=gAAAAABf95AE6RL2OwEQvL9KG6uUp1OLZQ_aUJR9X-jrCQFLXY_lNEDB76Bwi_773DLo7Od-BQRof45En-tk6aUjFQtMO-JEuHkzIIQvw4BDI0wZQwLY7Yff6DSdT3Rvy3Kjf3uVcAPMNzozJd2Vty19ZKvxT3O7wJL3dZ21S0Hqnz8zavwRjMX-dacVaLV9dGzOPLYxUDeA7wJ0GfDRiic4lqmjIjvTm_3WGPypQlwO3k3KYvhSQ14=&type=image/png" host=<my heroku app> request_id=1847a4d4-3baf-43d9-9263-ea5cd2edaab8 dyno=web.1 connect=0ms service=162ms status=200 bytes=1715 protocol=https
2021-01-07T22:49:40.733842+00:00 heroku[router]: at=info method=GET path="/element?url=gAAAAABf95AEdfrEATbvvCXTnJA3qpKRuge3IF2TolArGAfopP5YpXfM5LDP6LJSDlA_RtwZ6UD6UzUcthmJtvzWZZJkx_KtXfYYzM5VrPH-1ZXp_Z3kPAA9wvigWkoQuTY3l9-fTuqp2Cn7smu3xT3DB8v1SUcmJuLy_W1gwQoWneNWWLGC8HPQIfVs2FI3jws9saG-BZsQsqpJk4daOMgGNxgbva0mhH5r8uOCQAhq-qvlcWvi3vdGcWG5829zktYU-oer36xtoVaOVPcoJwnWulQ8xQcA8333t2LL5gXBu_pjkKnlciUmVPGe4q4isP_S5LbI2pMdUYlSgRsTO6yfmwWEAkt9PvFA_nsFLORVaEYdwim6_0blo-knPNGoAyUgvUaffuOl_b5E9ZgqptETUOaUFNIwmw==&type=image/png" host=<my heroku app> request_id=2d5e1263-c04b-4b56-a300-6b9b573e2630 dyno=web.1 connect=0ms service=134ms status=200 bytes=374 protocol=https

That being said, POST requests aren't typically supported on mobile browsers. If you entered the custom search engine on your mobile browser as <your whoogle url>/search?q=%s then that "%s" portion is filled with your search in plaintext and is sent as a normal GET request instead.

As for whether or not Heroku themselves can view the logs, I don't think they explicitly state that anywhere, but I would assume so. The search API was designed to hide as much from a log as possible, but is still subject to the limitations of what a user's browser provides in terms of custom search functionality.

If you are concerned about any plaintext searches appearing in logs, I'd recommend using a browser that supports POST requests by default, using the webpage search bar rather than the browser search bar (since the input field performs POST requests by default), or switching to a different search engine on devices that you can't perform POST requests on.

Hopefully that answers your question and wasn't too verbose!

[captainfuckface]

Actually, I didn't think anyone would answer my question so getting such detailed response from you was more than I could've asked for! Thank you for taking the time to explain this. It's much appreciated