Security at Social Fanout

Report a vulnerability

Email hello@socialfanout.com with Security report in the subject. Include enough detail to reproduce and evaluate the concern:

• The affected URL, endpoint, feature, or client.
• Reproduction steps using accounts and data you control.
• The impact you observed or believe is possible.
• A safe way to contact you for follow-up.

Automated security tooling can use the canonical security.txt record.

Responsible-testing boundaries

• Test only accounts, API keys, connections, content, and social destinations you own or are explicitly authorized to use.
• Do not access, alter, retain, or disclose another person's data. If you encounter it, stop and report the minimum necessary detail.
• Do not perform denial-of-service, high-volume automation, spam, social engineering, credential attacks, or destructive testing.
• Do not test Meta, X, TikTok, LinkedIn, Google, Pinterest, Reddit, or another third party through this policy; their systems and policies are outside Social Fanout's authorization.
• Coordinate disclosure before publishing details that could expose customers or make an unresolved issue easier to exploit.

Documented safeguards

• Server-side provider credentials. OAuth tokens are kept server-side and are omitted from public API and dashboard responses.
• Hashed API-key storage. Persisted Social Fanout API keys are stored as one-way hashes rather than plaintext values.
• Scoped authorization. Protected API operations use the authenticated key's owned connections, jobs, posts, and inbox records rather than accepting cross-customer ownership claims.
• Sanitized diagnostics. Public runtime-readiness failures report bounded status without returning dependency error details or credentials.
• Explicit action receipts. Publish and supported interaction operations retain status and provider-result receipts so customers can distinguish accepted, completed, failed, and action-required outcomes.
• Hosted transport. Use https://socialfanout.com for the hosted service; do not send credentials over an unencrypted connection.

Scope and accountability

These controls reduce risk; they do not make any internet service unbreakable. This page is not a SOC 2, ISO 27001, PCI, or other certification claim. Social Fanout also depends on customer-owned accounts and upstream social providers, whose availability, permissions, and security controls remain separate.

For data handling and retention, read the Privacy Policy. For service limitations, read the Terms of Service. For fresh hosted-runtime checks, visit Service Status.