Security

Architecture choices that reduce risk

• No credentials to steal:we never collect social media passwords, so a breach can’t leak them.
• Local-first processing: your export is parsed in your browser. Raw archives are never stored.
• Minimal data model: saved snapshots contain usernames and follow flags — not messages, photos, or contact info.

Technical measures

• TLS for all transport; HSTS in production.
• Upload hardening: size caps, ZIP-bomb protection (entry count, per-entry and total decompression limits), path-traversal filtering, and no execution of uploaded content.
• Strict security headers and a restrictive Content-Security-Policy.
• ORM-parameterized queries; no raw HTML rendered from imports.
• Secrets kept in environment configuration, never in the client bundle.
• Authorization checks on every account-scoped operation.

Reporting a vulnerability

Email [email protected]. We commit to acknowledging reports within 72 hours and will credit responsible disclosure if you’d like.