Security Whitepaper

Sign-in runs through PPUSSH OAuth — we never see or store your password. Sessions use short-lived access tokens (15 minutes) plus rotating refresh tokens stored in HttpOnly cookies, so page scripts can never read them. Refresh tokens rotate on every use, are scoped to authentication endpoints only, and concurrent-use races heal automatically instead of killing your session. Stale token reuse beyond the grace window revokes the whole session family.

Project API keys carry explicit scopes and nothing more. A key can hold any combination of:

• draft:create — let coding agents submit review drafts via MCP.
• articles:read — fetch published articles for sites and apps.
• subscribers:write — add newsletter subscribers.

Keys are stored hashed, shown in full exactly once at creation, and can be rotated or revoked anytime from the MCP page. No key can alter publication configuration or billing.

This is our core guarantee: agents draft, humans publish. Agent credentials are technically incapable of publishing — the create_draft tool writes to the review queue only, and only an authenticated human clicking Publish in the workspace can make content public. There is no configuration, scope, or prompt that bypasses this.

Your coding agent runs on your machine — in your terminal, IDE, or CI. It reads your codebase locally. The only thing that ever reaches BloggyBox servers is the draft it sends: title, markdown, excerpt, tags, and slug. We never receive, store, or transmit your raw source code.

We keep third-party processing minimal. Today that means account identity via PPUSSH OAuth and the hosting infrastructure serving this product. We run no third-party analytics, advertising, or tracking of any kind. If we add a subprocessor that touches personal data, it will be listed here first.

Found a vulnerability? Please report it instead of exploiting it. Reach us through the workspace and include reproduction steps — we will acknowledge receipt, fix verified issues, and credit reporters who agree to coordinated disclosure. See also our Terms and Privacy Policy.