Security and Responsible Disclosure

Social credentials

Platform tokens are encrypted with envelope encryption under a managed key, rotated, stored apart from content and billing data, and redacted from every log. A token is never sent to a browser, never placed in a model context and never included in an error message.

Tenancy

Isolation is enforced three times: at the edge when you authenticate, in the application service when it authorizes the action, and in PostgreSQL through row level security. Being signed in is never treated as permission. Cross workspace access attempts are tested in continuous integration and must fail.

Publishing integrity

Every external write carries an idempotency key and produces an immutable receipt. Duplicate publication is treated as a defect with a target of zero, and the test suite includes worker crashes after platform acceptance, platform timeouts, duplicated webhooks, revoked tokens at dispatch and daylight saving transitions.

The programme

• A written threat model covering OAuth, tenancy, publishing, MCP, media, billing and analytics.
• An independent security review focused on token leakage and cross tenant access before paid launch.
• Least privilege production access, multi factor authentication, and a device and session inventory.
• Dependency and container scanning with patch service levels, and signed build provenance where practical.
• Centralized logging that redacts by default, with anomaly alerting.
• Encrypted backups with tested restoration and a documented rotation.

Reporting a vulnerability

Email us with enough detail to reproduce the issue. We acknowledge within two business days, keep you updated, and credit you when you want the credit. Please do not access another customer data, degrade the service, or run automated scanning against production. Test against your own workspace.

We will not pursue legal action for good faith research that follows this policy. The exact safe harbour wording is with counsel.

If something goes wrong

We have an incident response plan with named decision makers, severity levels, evidence preservation and notification duties. Incidents that affected publishing are published on the status page with a timeline and what changed afterwards, including the ones we caused.