Security at Postbroad.
How to tell us about a security problem, and how we look after the accounts you connect.
Report a problem
Email hello@postbroad.com. Say what you found, the steps that show it, and what it affects. Please don't use the contact form for this, and don't post it in public. We read every report and write back.
The same address is in our security.txt file.
What we ask of you
- Test only with your own account and your own data.
- Never look at, change or delete anyone else's data.
- Don't slow the service down or send spam while you test.
- Give us time to fix the problem before you tell anyone else about it.
How tokens and app keys are stored
The tokens a network gives us when you connect an account, and the app secrets you add for networks that need your own app, are encrypted at rest with envelope encryption. Each secret is locked with its own random key (AES-256-GCM), and that key is locked again with a separate key that is never stored in the database. Each secret is tied to its own record, so a copy moved anywhere else can't be opened.
Only the background workers that publish your posts can open a secret, just before they call the network. The part of Postbroad that answers web requests can save or replace a secret, but can't read one back. An API key is shown once, when you create it, and we keep only a hash of it.
Data in transit
This website and the Postbroad app are served over HTTPS, so everything you send is encrypted with TLS on the way. This website also tells browsers never to use a plain connection.
Who processes data for us
- Cloudflare: Hosts this website and its form database, runs DNS and email forwarding, and runs the Turnstile check on the forms.
- Brevo: Sends transactional email, such as account emails and notices about your posts.
More about what we collect and why is in the privacy policy.