cometpost

Security

Last updated: · Reports: security@cometpost.app

1. Report a vulnerability

Email security@cometpost.app with what you found, the URL or API route involved, and the steps to reproduce it. Machine-readable contact details are in /.well-known/security.txt.

Please do not read or change other people's data, degrade the service, or publish the details before we have had a reasonable chance to fix the problem.

2. How cometpost limits the damage

This section lists what the product does today. It describes how the system is built and is not a certification.

Your social accounts

  • We never see your platform passwords. Every connection is the platform's own OAuth screen. You can revoke cometpost from the platform's connected-apps settings at any time.
  • Tokens are encrypted before they are stored. The access and refresh tokens we hold for your connected accounts are encrypted in the application with AES-256-GCM, and each one records which key version sealed it. The key is held in the service's configuration, separate from the database. It is not in a dedicated key-management service; the storage format is built so it can move to one later.
  • Connecting is bound to your browser. The state of a connect flow is tied to the browser that started it by a short-lived HttpOnly cookie, so a consent link cannot be handed to someone else to attach your account to theirs.
  • Sign-in is Google only. cometpost does not keep a password for you. Two-factor sign-in is whatever your Google account uses.

AI agents and API keys

  • Drafts by default. A new API key or assistant connection cannot schedule or publish. What it creates are drafts that you review and publish. You switch scheduling on per credential, deliberately.
  • Scoped. A credential can be limited to specific accounts. Outside its scope, reading a post or account answers as if it does not exist, and creating a post for an account outside its scope is refused.
  • Some things are always yours. Releasing a draft, retrying a failed delivery, deleting media, disconnecting an account, billing, creating credentials and deleting the account need you signed in. A key or an assistant asking for one is refused, whatever its settings.
  • Keys are stored hashed and shown once, when you create them. You can revoke a key or an assistant at any time; it takes effect on the next request.
  • Rate limited. Each key and each connected assistant gets 1000 requests per UTC day.

Isolation between customers

  • Every query that reaches a post, delivery, account or credential is limited to the caller's own workspace, through a small set of shared loaders. An automated cross-tenant test fails if an API route is added without being declared and tested against a second workspace.

Media and URLs we fetch for you

  • When an agent gives us a URL to fetch media from, we refuse private and internal network addresses, re-check the address on every redirect, connect only to the address that passed the check, and refuse any hostname that resolves to both a public and a private address.
  • Downloads are capped by size while they stream, and each workspace has a daily limit on how much media it can bring in, on every route.
  • Files uploaded directly are inspected (size and type) before they can be attached to a post.

In transit and on the web

  • The API sends Strict-Transport-Security (one year, including subdomains), X-Content-Type-Options: nosniff, and forbids being framed.
  • This website runs no first-party script beyond a small link-tagging file, and its Content Security Policy only allows that file and the cookieless analytics script.

Your data, on your terms

  • Export: Settings → Account → Download data export in the application.
  • Deletion: Settings → Account → Delete account. It needs a recent sign-in and your email typed in, starts immediately, cancels scheduled posts, and removes your workspace, posts, media and stored tokens. Billing and tax records are kept where the law requires. Where a platform documents a way to revoke a token, we revoke it. For platforms that do not, we delete our copy and you remove cometpost in that platform's settings. See the data deletion page.

Review

  • We have carried out internal security reviews of the API and its authorization rules, and tracked the findings and fixes in our repository. Those reviews were done by us, not by an independent firm.

3. What we do not claim

  • No SOC 2, ISO 27001 or similar certification.
  • No independent penetration test.
  • No uptime or response-time guarantee.

If any of this changes, it will be stated here once it is true.

4. Where your data lives

The application, its database and its scheduling engine run on Railway. Uploaded media is kept in Cloudflare R2 object storage. The full list of providers, with what each one receives, is on the sub-processors page.

5. Data processing agreement

If you use cometpost for your business and need a data processing agreement, email privacy@cometpost.app with “DPA request” in the subject line. See also the privacy policy.