Security at CPlanner

Encryption and secrets

OAuth access tokens, refresh tokens, webhooks, and bot credentials are encrypted at rest with authenticated AES-256-GCM using a server-only key. Tokens are never placed in localStorage, returned by account list APIs, or rendered in the UI. Secrets are supplied through environment configuration and should be managed by your deployment secret store.

OAuth protection

• Signed, expiring state values protect authorization callbacks from CSRF and account mix-up.
• PKCE is used for providers that support the authorization-code challenge flow.
• Provider callbacks validate state before exchanging a code.
• Disconnect and revoke flows remove stored credentials and mark failures for review.

Infrastructure

API routes require an authenticated Firebase session or an internal service key. Database queries are scoped to the authenticated user. Browser clients receive secure session cookies, not provider credentials. Production deployments should terminate TLS, enforce HSTS, restrict origins, and keep database, Redis, and worker networks private.

Monitoring and response

Security-relevant actions are recorded in workspace audit logs. Provider failures, expired tokens, permission revocations, rate limits, and publish errors surface as reviewable states rather than silent retries. Report a suspected vulnerability to support so we can investigate safely.

Backups and deletion

Backups are access-controlled and age out according to the configured retention schedule. Account deletion removes workspace records, connected accounts, scheduled posts, media references, and analytics data from the primary store; backup copies expire on the normal retention cycle.