Private work deserves care.

Account and data access

Customer API requests validate Supabase user tokens on the server. PostgreSQL row-level policies restrict brands and posts to their owner. Relationships between posts and brands also enforce matching owners. The browser uses a publishable key, not a privileged service-role key.

Request and content controls

The application validates supported fields, approval states and design links. Customer responses are marked private and non-cacheable. Browser security headers, origin validation for writes, and bounded request bodies provide additional safeguards. Content is rendered as text rather than arbitrary customer HTML.

AI keys, images and credits

Customer-owned OpenAI keys are encrypted using AES-256-GCM with customer-bound authenticated data and a server-only vault secret. Settings responses show only a key suffix. The AI and billing ledger is server-only; private image downloads validate account ownership. Hosted credits are reserved atomically before a generation, with one-time refunds for failed requests. Signed payment events are verified before granting credits. Checkout stays disabled until owner configuration is complete.

Approvals

Changing approved post content invalidates approval in the database. Publishing integrations are not active, so a target date or approved status does not send content to a social network.

What you should know

Sessions are stored by the authentication library in your browser; protect your device and sign out of shared browsers. No system can guarantee perfect security. The preview does not claim SOC 2, ISO 27001, GDPR certification, a completed independent penetration test, or an enterprise service-level agreement. Provider outages, backup recovery, abuse monitoring and incident handling still need operational review before a paid launch.

Report a vulnerability

Email info@growyourwebs.com with the affected URL, a minimal reproduction and expected impact. Please avoid including real customer records, passwords or access tokens. Limit testing to your own accounts and do not disrupt the service or access another person’s data. No paid bug-bounty or blanket authorization to test third-party services is offered.

Privacy

For personal-data requests, use the same contact and see the privacy notice. For current product limits and integrations, see product status.