Hi Tino,
you're right, we haven't solved the problem, when you authorize an app to post, vote and so on you must trust that who manage that account do not use this authorization for something that you do not want.
Now I'm hard working on the solution and have no time for this, when I have some time I try to check if is possible to develop a solution that, instead of using a local db, uses jsons directly written on the steem blockchain.
I think that this solution is too slow and too steem api demanding to be functional, but we can get it a try and see if all can work properly.
Another problem that is related to this solution is that write a custom json can be done using posting key, so who has your authorization, also another app, not only steem-fanbase, can also write a custom json for you and the fact that in the blockchain there is such a configuration does not mean for sure that you have personally set it up.
This way you have to trust steem-fanbase and ALSO all other app you eventually have authorized, this spread the problem instead of solve it.
In the first version of steem-fanbase I try to have a better confidence that you are you using this trick: when you want to make some changes you have to send 0.001 steem, that the app immediately send you back, to activate the modification process.
This way to modify your configuration on steem-fanbase you have to demonstrate to have the active key.
This solution was too tricky, many errors come during this process, some haven't back their 0.001 steem, and I finally resolve to eliminate this check.
In the meantime I try to mitigate the problem with transparency.
I will add asap the functionality of downloading a csv file with all actions that steem-fanbase had taken in your behalf, I know that is not the perfect solution, but is a simple way you can check what the app do for you and all the changes that have been done on your configuration parameters.