Last updated 2026-10-27
Security
Security controls this Dealzcan deployment actually uses.
Authentication
Passwords are stored as scrypt hashes. Sign-in creates a server session and an httpOnly cookie. Failed attempts can lock a user. A newly registered account cannot sign in until the email verification link is used.
Access control
Roles are viewer, operator, admin, and owner. Settings, network changes, and user management require the matching role. Requests are limited to the signed-in workspace.
Credential protection
OAuth tokens, Page tokens, bot tokens, webhook URLs, and WhatsApp tokens are encrypted with AES-256-GCM before storage. API responses for those connections do not return the secret. Disconnect clears the blob.
Secure communication
The production site is served over HTTPS. OAuth callbacks require a signed-in member with network permission, a single-use state, and CSRF protection on the connect request.
Audit logging
Administrative actions are written to an audit log. Public deletion and contact requests record the action and a reference code. They do not record the message body in the audit detail.
Deletion requests
A public deletion form or a verified Meta signed request creates a tracked request. Data is deleted when an admin or owner marks that request completed after checking identity and authority. The public status page shows the code, type, status, and a fixed rejection reason. It does not show email, account identifiers, or Meta user ids.
What is not claimed
This page does not claim SOC 2, ISO 27001, or that every database column is encrypted by the application. Captions, emails, and publish history are stored in Postgres without a second encryption layer.