Secure by default · open to audit
Seven walls
around one video.
Kervly holds the keys to your channels, so every layer assumes the one outside it already failed. Pick a wall to see what it does.
- Dashboard sign-in
- Single admin. Password (PBKDF2-SHA256) + mandatory TOTP 2FA, per-IP rate limit, TOTP codes cannot be reused.
- Sessions
__Host-cookie, HttpOnly, Secure, SameSite=Lax, 8 h. Only a hash of the session token is stored.- CSRF
X-CSRF-Tokenheader + Origin check on every write.- MCP
- OAuth 2.1 with PKCE and dynamic client registration. Tokens are issued only after the admin signs in and approves the client. 1 h access tokens.
- Platform tokens
- AES-256-GCM encrypted in D1, bound to brand + platform. Never returned by any API, log or MCP tool.
- Least privilege
- YouTube:
youtube.uploadonly. Instagram:instagram_business_basic,instagram_business_content_publish. TikTok:user.info.basic,video.publish. - Media allowlist
- A brand can only publish
.mp4files under its own allowlisted prefixes, on allowed hosts only. MCP cannot change the allowlist. - Abuse limits
- Per brand and platform daily limit, capped by a server-wide ceiling. The same video can’t be scheduled twice for the same time.
- No double posting
- Each post is claimed with a conditional update before processing. Errors after an upload finished never trigger a re-upload.
- Secrets
- None in the repository. Secrets live in Cloudflare; personal resource ids come from GitHub variables. CI scans the history with gitleaks.
Found something?
Report it privately.
Please don't open a public issue. Use GitHub's private vulnerability reporting with steps to reproduce and the impact. You'll get an answer within 7 days.
In scope
- ✓The Worker code: authentication, sessions, OAuth and MCP, token storage, media allowlist, publisher
- ✓Deployment scripts and GitHub workflows
Out of scope
- ✕Vulnerabilities in YouTube, Instagram, TikTok or Cloudflare themselves
- ✕Issues that need an already compromised admin or Cloudflare account