Keep credentials outside your code

SocialCli stores secrets locally for each brand in .secrets/ with restricted permissions. These are plain text files: protect your system account, disk and backups.

The repository excludes .env, .secrets/, local state and creator files. Gitignore does not remove secrets from an existing history. Never publish tokens, client secrets, SSH credentials or private diagnostics.

Publishing and uncertain results

Review the complete preview before confirming. An interrupted request may have reached the provider: check the remote result before repeating it to avoid duplicates.

Report a vulnerability

Use Security → Report a vulnerability on GitHub. Do not open public issues with credentials or details that allow account access. If you suspect exposure, revoke and rotate the credential with its provider. If private reporting is unavailable, contact the maintainer through their GitHub profile.

Security channel