Security is part of the product

Overview

We design every feature with one question first: what happens if someone tries to misuse this? The answers shape the product, from how you sign in to how a webhook reaches your server.

• Phishing-resistant sign-in with passkeys, plus two-step codes for passwords.
• Least privilege by default: four roles, and every action checked on the server.
• A complete audit trail of every change, with who, what, when and from where.
• No card numbers on our servers. Payments go through Stripe.

Accounts and sign-in

Passkeys first

You can sign in with Touch ID, Face ID, Windows Hello or a security key. A passkey only works on sourcedeck.pages.dev, so a fake sign-in page can't capture it.

Passwords, done carefully

Passwords must be at least 12 characters and are checked against common choices. We store them with PBKDF2-SHA256 and a unique salt, never in readable form. Two-step sign-in with an authenticator app is available on every plan.

Lockout and alerts

After 5 wrong passwords, sign-in for that account pauses for 5 minutes and the workspace owner is told. Our error messages never reveal whether an email has an account.

Sessions you control

Session tokens are random, sent only in secure, HTTP-only cookies and stored on our side as SHA-256 hashes, so a database leak would expose no live session. You can see every signed-in device in Security and sign any of them out. Changing your password signs out every other device.

Roles

Owners manage billing and members. Admins manage sources and delivery. Editors download and route media. Viewers browse the library. Every request is checked against the role on the server, not just hidden in the interface.

Your data

Sourcedeck only collects posts that their owners made public. Your workspace data (sources, rules, captions, members and library) is separated per workspace and checked on every request.

• All traffic uses TLS 1.2 or later, with HSTS.
• Sensitive fields such as API keys, webhook secrets and two-step secrets are encrypted with AES-256-GCM. API keys are shown once and then stored only as a hash.
• Backups run every night, are readable only by the service account, and are kept for 30 days.
• When you delete your workspace, your data is removed within 30 days, including from backups as they expire.

Payments

Card payments are handled by Stripe, which is certified to PCI DSS Level 1. Your card details go straight from your browser to Stripe. We keep a reference to the payment, never the card number.

Each payment is processed exactly once. If a confirmation arrives twice, or a network error forces a retry, the second attempt is recognised and ignored, so you are never charged or upgraded twice.

Infrastructure

• The website is served with a strict Content Security Policy: no inline scripts, no third-party trackers, and framing blocked.
• Requests that change data must come from our own origin and carry a custom header, which stops cross-site request forgery.
• Servers accept SSH with keys only. Our collection workers connect out to the core service over a single encrypted channel and expose no open ports of their own.
• Secrets live in locked-down environment files on the servers, never in source code.
• Database changes only ever add to the schema. Nothing is dropped in an update.

Monitoring and response

Every source is checked within the limits its platform allows. When a platform slows us down, Sourcedeck backs off and retries on its own instead of hammering it, and nothing collected is lost. Health checks alert us when delivery falls behind, and our workers restart and reconnect by themselves.

If we ever find that your data was exposed, we will tell affected workspace owners within 72 hours, with what happened and what we are doing about it.

Report a vulnerability

If you believe you've found a security issue, email bavarvasneh@gmail.com with the steps to reproduce it. We reply within 2 working days and keep you updated until it is fixed.

Please test only against your own account, don't access other people's data, and give us a reasonable time to fix the issue before you share it. We won't take legal action against research done in good faith under these rules, and we're happy to credit you.

Our security.txt has the same details in a machine-readable form.