Security.
In force from 17 September 2026
The short version
Every connection is HTTPS, passwords are hashed and cannot be read, and the tokens for connected accounts are sealed with encryption before they are stored. No page, email, export or agent tool ever returns a token.
Every query is scoped to one account. Vulnerabilities go to security@billboardbadger.com.
This summary is here to be read. The clauses below are what actually binds.In transit
Every connection is HTTPS, enforced with HSTS.
Passwords
Hashed with PBKDF2 SHA 256 and a unique salt. They cannot be read, only reset. Changing a password or email signs out every other device.
Connected accounts
Connections are made only through each platform's own sign in, never with a password or a pasted token. Tokens are sealed with AES GCM before they touch the database, bound to their own row, and opened only by the part of the service that sends for that account. No page, email, download or MCP tool returns one.
Isolation
Every record belongs to one account and every query filters by it, in the query itself.
Your agent
An MCP client connects over OAuth and reaches only the account that granted it. No tool can connect a channel or switch Autopilot on.
Infrastructure
Billboard Badger runs on Cloudflare: Workers, D1, KV, R2 and Durable Objects. Pages carry a strict Content Security Policy and rate limits guard sign in, sign up and writes.
Reporting a vulnerability
Email security@billboardbadger.com, also published in security.txt.
Ask, and the wording gets fixed rather than explained.