Security
Security at VI Engine
This page covers the security-related behaviors we can verify in the current frontend and connected account flows. It is deliberately specific and avoids making sweeping claims that the product does not currently prove.
Current, verified scope
This page is intentionally limited to what the product currently proves in its customer session, route-gating, and connected-account behavior.
Customer dashboard sessions
Customer authentication currently uses a short-lived access token together with a refresh token. The frontend stores both values in localStorage. To let Next.js middleware protect customer routes before the app hydrates, the frontend also mirrors the current access token into the first-party vi_access_token cookie. Because that cookie is written by frontend code, this page does not claim that customer auth tokens are stored in HttpOnly cookies.
Route gating in the current app shell
Customer routes are gated, and internal operations tooling uses a separate internal authentication flow.
Connected social accounts
Social account connections use official OAuth 2.0 authorization-code flows. Platform credentials returned by those flows are stored on the backend in encrypted form using AES-256-GCM and are used for the platform actions you authorize, such as publishing, analytics sync, or connection-health checks.
Evidence-based scope
This page is intentionally limited to controls we can verify in the current frontend and connected-account flows. It does not make blanket promises about browser headers, cookie flags, or CSRF-cookie behavior unless those details are directly reflected in the current code and verified product behavior.
Contact security
For security questions or vulnerability reports, email security@viengine.social.