Waking up your workspace
Security should not need a dictionary. Below is everything PostHub does to keep your account and your content safe — written the way we would explain it to a friend, with no roadmap talk and no certificates we have not earned.
No single lock does all the work. Tap any layer to see what it does in plain English.
When you sign in you get a short-lived pass plus a longer refresh pass. Each time it refreshes, a brand-new pass replaces the old one. If an already-used pass shows up again we assume it was stolen, shut down every session in that family instantly and record the attempt as a security event. Changing your password or choosing "log out everywhere" switches off every older session too.
Passwords are stored as one-way scrambles — we never keep the real thing. Three wrong passwords on one account within ten minutes locks it for fifteen minutes and sends you an alert email, throttled to one per hour. Our staff sign-in page locks the requesting address for thirty minutes after five straight failures, and the counters live in our database, so a server restart never resets them.
We limit how many requests someone can make in a given window to stop abuse and keep the site running smoothly for everyone. The counters stay correct even when many requests arrive at once and survive server restarts. Important routes — signing in, one-time codes, password resets, uploads, staff pages — shut the door rather than open it if the counting system is ever unavailable.
We verify that requests come from our own site, not from malicious third parties. Before any action that changes data, we compare the browser’s origin information against a trusted list, respect the browser’s own site hints when it sends them, and check a signed token tied to your session. Dozens of routes use this protection today.
We look inside every file to confirm it is a real image (PNG, JPEG or WebP) instead of trusting the file name. Images are then rebuilt from scratch, which strips hidden extras like GPS location data and anything secretly appended to the end. The file is stored under a name we invent, never the one you uploaded. Sign-in checks, rate limits and your storage quota all run before anything touches the disk.
We prevent the server from being tricked into accessing internal network resources. Whenever the app fetches a web address, it first checks where that address really points, blocks private or internal destinations, and stays pinned to the safe answer even when redirects change course. If something goes wrong you get a short, plain error — never internal details or a stack trace.
Your data is encrypted on our servers, so even if someone reached our storage they could not read it. Access tokens from connected social accounts are sealed with strong AES-256 encryption and opened only inside our server code when publishing or reading analytics. They are never sent to your browser, never written to logs, and are wiped the moment you disconnect an account.
Every response tells the browser to only ever use a secure connection, blocks clickjacking attempts, refuses unsafe file-type guessing, limits leaked referrer information and switches off camera, microphone, location and payments. A strict content security policy rides along on every response and can be flipped to full enforcement with one setting.
We check that all security settings are properly configured before the app starts. If a required key is missing or looks wrong, the app refuses to boot with a clear message instead of quietly running with weaker protection than you were promised.
Tests covering our security guards run on every code push, alongside a secret scanner and an extra check that flags risky database queries before they ship. One thing we built but have not switched on yet: a captcha challenge on the sign-in page. Rate limits and lockouts cover those pages in the meantime — we would rather tell you plainly than imply a protection that is not active.
Every measure above belongs to one of four domains. Together they cover your data, who can reach it, the network around it, and how we keep ourselves honest.
What we store, and how it is sealed away.
Who can get in, and what happens when they should not.
The gate between PostHub and the wider internet.
How we catch mistakes — and what we refuse to overclaim.
If you find something wrong — a way into someone else's account, a leak of stored data, an access path that should not exist — write to support@posthub.shorix.io with what you did, what you expected and how to reproduce it. You will get a human reply acknowledging the report, followed by an honest timeline while we fix it. We will not threaten you for reporting in good faith, and we will coordinate the disclosure with you rather than around you.
To be straight with you: there is no paid bug-bounty program here. PostHub is a small team and we will not advertise rewards we cannot fund. Reports are still read, prioritised and fixed — and if you want credit when the fix ships, say so and we will give it.
Contact the teamThis page is reviewed whenever one of the systems above changes. If you spot something here that the code no longer does, tell us and we will correct the page.
support@posthub.shorix.io