SECURITY
Consequential writes are fenced by identity, scope, intent and durable evidence.
PostSteward is designed to fail closed when it cannot prove who is acting, where work is going or whether an external effect may already have happened.
Authority is explicit
- Owner browser sessions are separate from delegated agent bearer grants.
- Agent grants are scoped, expiring and revocable; admin authority is not delegated through the grant endpoint.
- Social destinations are stored with stable provider identity so an alias cannot silently redirect already-reviewed work.
- Private GitHub source access uses selected-repository read-only authority and is separate from publication scopes.
Credentials are treated as credentials
Provider access/refresh material and supported private-source authority are encrypted server-side. Browser code avoids persistent storage of provider or agent secrets. OAuth state, PKCE, owner completion proof, CSRF and same-origin checks bound browser flows to the initiating owner session.
Protected root-key rotation uses authenticated encryption context and staged cutover/rehearsal rather than rewriting secrets blindly.
External effects are durably fenced
PostSteward records an idempotency/effect boundary before consequential provider work. A known no-effect rejection can permit a reviewed retry. An ambiguous write remains fenced because repeating it could create a duplicate social post.
Provider creation IDs and independent readback are separate evidence. A verified receipt requires the provider record to match the captured stable author and exact reviewed content when the provider exposes that capability.
Recovery preserves external reality
Exact recovery checkpoints restore PostSteward state, not the external world. Preparing recovery quarantines new provider writes. The owner must reconcile restored authority and external-effect evidence before resuming publication. Exact undo is available only while its recorded bookmark and plan state remain valid.
If a receipt is ambiguous, inspect the existing provider/effect evidence. Deleting the ledger would remove a safety control, not prove that no post exists.
Edge and release controls
The Worker applies content-type/body bounds, origin checks, rate limits, security headers, restrictive CSP, no-store responses for private data and exact-host validation for external navigation. Main-branch changes are protected server-side with signed, linear, squash-only PR merges and a required GitHub Actions verification check.
Production readiness remains evidence-based. A feature can be implemented but still blocked by provider application approval, deployment policy, capacity evidence or another external gate.
Report a security concern
Use the support guidance and clearly mark the report as security-related. Do not place access tokens, refresh tokens, agent bearer tokens, payment credentials, private source contents or other secrets in a public issue. Include a bounded PostSteward request/reference ID when it helps investigation.