Security
Security for a tool that acts on your replies.
ReplyTidy limits account permissions, verifies incoming delivery, protects credentials on the server, and keeps moderation actions visible and reversible.
security / current
Limited Threads permissions
ReplyTidy requests Threads basic profile access and reply-management access. Those permissions support account connection, new-reply moderation, and hide or restore actions.
Verified reply delivery
Incoming Threads webhooks are checked with a constant-time HMAC signature comparison before any reply is admitted to the moderation queue. Oversized or slow request bodies are rejected within bounded limits.
Server-side credentials
Threads tokens, provider keys, and application secrets remain server-side. The browser receives only the product data and actions needed for the current signed-in account.
Bounded background work
Reply processing uses durable queue claims, deduplication, bounded provider concurrency, rate limits, and retry ceilings so one failure or burst cannot silently create unlimited work.
Recoverable moderation
ReplyTidy hides rather than deletes replies. Decision evidence and human corrections stay in the audit trail, while resolved sensitive detail is redacted under the configured retention policy.
Report a vulnerability privately
Send suspected vulnerabilities or exposed-credential reports to [email protected] before opening a public issue. Include reproducible facts without including live secrets.
Report a security issue