Security

FullSite Social uses official authorization-code flows. Customers authenticate directly with the provider; provider passwords never pass through FullSite.

• HTTPS and secure, HTTP-only session cookies in production
• One-time OAuth state validation and CSRF protection
• Authenticated encryption for stored provider credentials
• Server-side secret handling and log redaction
• Role and customer-bound authorization checks
• Explicit confirmation before test publishing
• Login throttling, auditable events and disconnect controls

Report suspected vulnerabilities privately to security@fullsite.social. Do not include live credentials in reports.