Security
A scheduler holds the keys to your social presence, so credential handling is the core of our security posture. This page describes how Postauto protects your accounts and how to report a vulnerability.
1. Credential encryption
- Every social credential (OAuth access and refresh tokens, app passwords, bot tokens, webhook URLs) is encrypted with AES-256-GCM before it is written to the database. Credentials are never stored or logged in plaintext.
- The encryption key lives in the server environment, outside the database, so a database leak alone does not expose usable tokens.
- Tokens are decrypted only at the moment of publishing and are never returned to the browser or shown in the UI.
2. Least-privilege connections
Wherever a network offers a scoped credential, we ask you to use it instead of your main password:
- Bluesky: connect with an app password (Settings, then App Passwords), never your main account password. You can revoke it at any time without changing your password.
- Telegram: connect through your own bot token, scoped to the channels where you made the bot an admin.
- Discord: connect a single channel webhook, which can only post to that channel and can be deleted from Discord at any time.
- OAuth networks (X, LinkedIn, Meta, Google, and others): we request only the scopes needed to publish, and you can revoke Postauto from the network's own settings at any time.
3. Media and data handling
- Uploaded media is served through signed URLs, so files are only reachable with a valid, expiring signature rather than by guessing a public path.
- All traffic to and from Postauto is encrypted in transit with TLS.
- Passwords are stored as salted hashes through our authentication system.
- Payments are processed by Stripe; full card numbers never touch our servers.
4. Infrastructure
Postauto runs on EU-hosted infrastructure (Hetzner, Germany) behind Cloudflare. Access to production systems is restricted and key material is kept out of the codebase. The full provider list is on the subprocessors page.
5. Reporting a vulnerability
If you believe you have found a security issue, email [email protected] with enough detail to reproduce it. Please do not access other users' data or disrupt the service while testing. We will acknowledge your report quickly, keep you informed, and will not take legal action against good-faith research that respects these boundaries.
6. Questions
Security questions that are not vulnerabilities: [email protected]