Security

Authentication

Sign-in is handled by Google OAuth or email and password, with sessions issued as signed JSON Web Tokens. We never store a plaintext password.

Programmatic access uses OAuth 2.1 with PKCE against our own identity provider. Access tokens are short-lived and validated on every request against a public key, so no shared secret is distributed to clients.

Tenant isolation

Your account identity is derived from your authenticated session, never from a parameter in the request. A request cannot ask for another account's data by changing an identifier, because the identifier is not an input.

Every database query in the backend is scoped to the authenticated account at the repository layer rather than in individual features, so a new feature inherits isolation instead of having to remember it.

Secrets and credentials

Application secrets are held in Google Secret Manager and injected at runtime. They are never committed to source control and never written into job payloads.

Deployments run through Workload Identity Federation, so our continuous integration holds no long-lived cloud service account key.

Credentials and sensitive request content are redacted before anything is written to logs.

Data handling

Measurement evidence is append-only. Once we record what an answer engine said, that record is not edited or overwritten. Corrections are made by re-measuring and recording a new observation alongside the original.

When we fetch a web page as evidence, the fetcher is guarded against server-side request forgery, unsafe redirects and oversized responses.

Access control on our side

Production infrastructure is scoped so that each service holds only the permissions it needs, and those permissions are declared in version-controlled infrastructure code rather than granted by hand.

Cloud resources for the measurement backend are isolated by naming convention and default-deny, so that service cannot reach infrastructure belonging to other parts of the product.

Reporting a vulnerability

Email team@om.linkeddit.com with the details and how to reproduce it. We will acknowledge you, and we will not pursue action against good-faith research that avoids privacy violations, service disruption and data destruction.