Security Controls, Described Honestly

Your social account credentials are encrypted when stored and never sent back to the browser, so there is nothing useful to read even if a request were intercepted.

Publishing, approving, connecting accounts and managing a workspace each require a specific role, re-checked on the server for every sensitive action.

No scheduled or immediate publish can proceed without a server-verified approval on the exact content revision being sent - verified directly on the server before sending.

Connection, approval and publishing actions are written to an audit trail as they happen, independent of what the interface displays.

Connected account credentials are retrieved from encrypted storage only when needed for each action and are never kept accessible in a way that could be reused if exposed.

When multiple team members work on the same content, version checks prevent one person's updates from silently overwriting another's.

When publishing pulls a remote image, the destination address is validated and pinned before the connection is made, guarding against a type of attack that could redirect image links to unsafe destinations.