Skip to main content

Security

Security for a tool that acts on your replies.

ReplyTidy limits account permissions, verifies incoming delivery, protects credentials on the server, and keeps moderation actions visible and reversible.

security / current

Limited Threads permissions

ReplyTidy requests Threads basic profile access and reply-management access. Those permissions support account connection, new-reply moderation, and hide or restore actions.

Verified reply delivery

Incoming Threads webhooks are checked with a constant-time HMAC signature comparison before any reply is admitted to the moderation queue. Oversized or slow request bodies are rejected within bounded limits.

Server-side credentials

Threads tokens, provider keys, and application secrets remain server-side. The browser receives only the product data and actions needed for the current signed-in account.

Bounded background work

Reply processing uses durable queue claims, deduplication, bounded provider concurrency, rate limits, and retry ceilings so one failure or burst cannot silently create unlimited work.

Recoverable moderation

ReplyTidy hides rather than deletes replies. Decision evidence and human corrections stay in the audit trail, while resolved sensitive detail is redacted under the configured retention policy.

Report a vulnerability privately

Send suspected vulnerabilities or exposed-credential reports to [email protected] before opening a public issue. Include reproducible facts without including live secrets.

Report a security issue