Creator Experience
Key controls
- Client secrets remain server-side.
- OAuth access and refresh tokens are encrypted at rest.
- The OAuth flow uses PKCE and state, and the web session is protected by HttpOnly and Secure cookies in production.
- HTTPS is required in production.
- The external application blocks iframe embedding through Content Security Policy and keeps only a limited legacy redirect route.
- CSRF protects state-changing requests.
- Admin tooling is disabled by default in production.
- OAuth scopes are limited to documented functionality.
Responsible disclosure
Send vulnerability reports to [email protected], including reproduction steps, impact and a safe proof of concept. Do not access unrelated creator data, disrupt the service or publish details before remediation.