Postroom Security and access boundaries
What is protected, and how to report an issue.
Keep credentials private
Provider secrets and service credentials belong on the server. Never put them in screenshots, public docs, browser-visible configuration or assistant prompts. Customer sign-in tokens are verified by the backend before owner-scoped data is returned.
Reporting a concern
Contact founder@notacompanynameyet.com with a minimal reproduction and the affected page. Avoid sending secrets or another customer’s data. We do not claim certifications or a public bug-bounty program that have not been established.
Database access model
Customer-facing requests are authenticated before server operations. Billing and new workspace-management tables deny direct anonymous and customer-role access; server operations apply ownership or membership checks. These checks do not constitute a completed independent security audit.
Your operational responsibilities
Protect your sign-in inbox and social-provider accounts, use strong passwords, and revoke unused assistant connections. Share only the minimum sample data in reviewer accounts. Keep secrets out of recordings and public walkthrough descriptions.
