This page is written in plain language. It is a draft that is being reviewed by a lawyer, and we will update it if anything changes as a result.
- Sign in goes through OfficeBats, with two factor authentication available.
- Social tokens and secrets are encrypted at rest with AES 256 GCM and never sent to the browser.
- OAuth uses the authorization code flow with PKCE where the network supports it, and a random state that expires after 10 minutes.
- Roles limit what each member of a workspace can do, from viewer to owner.
- Requests to addresses you give us (RSS feeds, webhooks, pages for AI, Mastodon and Lemmy instances) only go to public internet addresses, with time and size limits, to prevent server side request forgery.
- Webhooks we send are signed with HMAC SHA 256 so you can verify them.
- Uploads are checked by their content, not their name, and served with strict headers.
- Encryption in transit with HTTPS everywhere.
- Publishing uses a job runner with leases, so a post is never published twice by two servers at once.
- No scraping: every network connection uses that network's official API.
Report a problem
If you find a security issue, please write to [email protected]. We will reply quickly and credit you if you wish.