actually, REST Console doesn’t need access to all your “data” on all website, I think that’s mis-wording on Google’swebsite behalf.
the application asks for the following permissions:
“permissions”: [
“http://*/*”,
“https://*/*”
]
this basically allows the app to make HTTP calls to any URL, which is obviously the intent of the app, however it does not access any other information.
the application is open-source so you are free to checkout the inner workings of it at the github project page: http://github.com/codeinchaos/rest-console