Security at Ovation

1. Current status

Production and staging use separately scoped services and credentials. Payment collection is hosted by Stripe, private reports require authentication, and provider access is limited to the product’s documented source boundary.

2. Core controls

• Supabase bearer authentication, row-level security, and service-role-only RPCs.
• Same-origin mutations, strict request schemas, bounded bodies, output encoding, no-store APIs, and restrictive browser headers.
• Atomic quotas, job leases, cron claim tokens, retries, and idempotent completion.
• Independent worker, cron, privacy, OAuth-encryption, Stripe webhook, and Resend webhook secrets.
• Verified phone numbers encrypted with a dedicated key, provider-signed SMS callbacks, separate opt-out state, and a final authorization immediately before every text.
• Raw public comments remain in bounded processing memory and are not saved by Ovation.
• Report, export, X disconnect, and account-deletion lifecycle tests.

3. Source security

Instagram, TikTok, and YouTube are public inputs for the saved creator identity. YouTube uses a server-only Data API key and does not ask for creator-account permission. Its comment analysis fails closed unless the required provider approval is recorded.

Only X has a Connect flow. It uses state, PKCE, minimum read-only scopes, encrypted server-side tokens, refresh handling, and revocation/disconnect. Tokens never enter URLs, browser storage, analytics, support records, or logs.

Focus Scan URLs are HTTPS-only on exact supported hosts, canonicalized to provider IDs, and accepted only after provider ownership checks. The server never fetches an arbitrary user URL.

4. Payment and delivery security

Stripe hosts payment collection. Ovation validates the fixed Price, verifies raw-body webhook signatures, deduplicates events, and derives entitlements from current subscription state. A browser redirect cannot grant paid access.

Resend report email uses escaped content, deterministic idempotency, signed webhook events, and bounce/complaint suppression. The current confirmed account email is resolved at send time rather than stored in the delivery outbox.

Twilio verifies phone ownership and sends bounded plain-text report links. Ovation stores the number encrypted, keeps it out of delivery jobs and logs, verifies Twilio signatures, and processes STOP separately from email preferences.

5. Report a security concern

Email help@swaynexa.com with the affected URL, reproduction steps, impact, and a safe proof of concept. Do not access another person’s data, use denial of service, or include credentials or payment-card data.

This overview is not a certification, bug bounty, or authorization to violate law or third-party terms. No security control eliminates all risk.