Skip to main content

Security

  • Keys and tokens stored only as SHA-256 hashes; key shown once; immediate revocation.
  • OAuth 2.1 with PKCE; short-lived, rotating tokens with reuse detection.
  • Limited scope: a connector only sees credits and tools, not brands, analyses or payments.
  • SSRF protection: audited addresses must be public (http/https, ports 80/443); DNS checked first and IP re-checked at connection time; redirects verified one by one; response size and time limited.
  • Rate, concurrency and daily capacity limits. Infrastructure in the EU (Germany), HTTPS, security headers, regular backups.

Security reports: clarity@whooho.it.