Security
Built so you can hand us the keys, and take them back.
Vane holds access to your social accounts, so we treat every credential as the most sensitive thing we store. This page says what we do, in plain terms, and what we do not claim.
Your credentials
- Social network sign-ins and webhook secrets are encrypted at rest with AES-256-GCM.
- API keys are shown once and kept only as SHA-256 hashes: nobody at Vane can read your key back.
- Passwords are stored as salted PBKDF2 hashes; sessions are stored as hashes and travel in a secure, HttpOnly cookie.
- Secrets live in a secrets store, never in code, and are never written to logs.
Least privilege
- Each network gets the smallest permission that lets Vane publish: for LinkedIn, name and “create posts”; for Threads, username and “publish”.
- Vane does not read your feed, messages, followers or connections.
- Bluesky uses an app password, so your main account is never opened.
- API keys are scoped: text keys cannot touch video endpoints, and test keys post nothing.
Abuse and bot protection
- Cloudflare Turnstile checks sign-in and sign-up; a 6-digit email code confirms new accounts and new sign-ins after a few days away.
- The whole API sits behind a shield: per-address and per-key rate limits, blocking of attack tools and scanners, and automatic bans for repeated probing.
- Wrong API keys, password guessing and sign-up floods are limited per address.
- Calls from payment providers and social networks are accepted only with a valid signature or secret.
Safe by design
- Webhooks go only to public https addresses (no IP addresses, no internal names, never Vane itself) and never follow redirects, so they cannot be pointed at our internals.
- Every database query is parameterized; errors never leak internals to the page.
- Your post links to images use long random addresses, and video links are private until you create a public one.
- Card details never touch Vane: they go to the payment provider’s own page.
You stay in control
Disconnect any network in one click, revoke any key, delete any post or video. Removing Vane in LinkedIn’s or Threads’ own settings stops it at once: for Threads the network tells us, and we delete the connection and its data. See Data deletion and the Privacy Policy.
What we do not claim
Vane is a young product. We have not been through a formal audit or certification such as SOC 2 or ISO 27001, and we will not pretend otherwise. What we do is the list above, and we keep it honest and current. If a customer needs a security questionnaire, write to us.
Found a problem?
Please tell us at the contact form and give us a reasonable time to fix it before you share it. Do not access other people’s data or disrupt the service while you test. We read every report.