Security

Updated: September 15, 2026

FullSite Social uses layered administrative and technical safeguards appropriate to the service and its data.

Account and application security

• HTTPS and secure, HTTP-only production session cookies
• Strong password hashing, time-limited single-use enrollment and reset links, login throttling, CSRF protection, and customer-bound authorization checks
• One-time OAuth state validation and official authorization-code flows; provider passwords never pass through FullSite
• Explicit review and confirmation controls before publishing

Data and infrastructure

• Authenticated encryption for stored platform credentials
• Server-side secrets separated from source code and redacted from logs
• Access limited by job function and service need
• Security and publishing audit records, controlled deployment, backups, monitoring, and dependency maintenance
• Credential removal on disconnect and provider revocation where supported

Response

We assess credible reports, contain and remediate verified issues according to severity, preserve relevant records, and provide legally required notices. No internet service can guarantee absolute security. Customers should use unique passwords, protect registered email accounts, review authorized users, and promptly disconnect or contact us if compromise is suspected.

Report a vulnerability

Email security@fullsite.social with the affected URL, impact, and reproducible steps. Do not include live credentials, personal data, or destructive proof. Allow a reasonable investigation period before public disclosure. Good-faith research must avoid privacy violations, disruption, social engineering, and data destruction.