Security

Loresta applies tenant and creator boundaries before provider or supporter state can change.

Single-use OAuth state

OAuth state values expire, are hashed at rest, and can only complete once.

Tenant-scoped access

Dashboard sessions, agent keys, provider installations, and entitlements are checked against their workspace and creator profile.

Revocable permissions

Creators can disconnect provider accounts and Discord installations. Contribution refunds and disputes reconcile role access.

No provider secrets in the API

Public API responses do not return social access tokens, Discord bot credentials, or OAuth client secrets.

API request boundaries

Agent keys are workspace-scoped, expire, can be revoked, and expose only their selected scopes. Browser requests from unknown origins are rejected, but Agent keys should still be used only from trusted server environments.

Every response receives an x-request-id. Authentication errors include a bearer challenge. JSON responses use Cache-Control: no-store.

Write safety

Drafting requires an idempotency key and never sends the returned text. Handoffs require explicit confirmation. Tenant-scoped profile and conversation lookups return 404 rather than revealing whether another workspace owns an identifier.

Provider and callback safety

OAuth state is single-use and expires. Discord HTTP interactions require a valid Ed25519 signature and timestamp. Provider and payment callbacks are verified before state changes.

Creator Page identity signals

A verified connected-account signal on a Creator Page means Loresta confirmed control of the named X account through supported OAuth. Creators cannot type or upload this badge themselves. The signal does not verify every statement, offer, affiliation, product, or person associated with the Page, and it is removed when the connection no longer matches current provider evidence.

Every public Creator Page includes an identity-report action. Duplicate account claims, changed X identities, and impersonation reports enter a restricted operator queue. Operators record evidence before verifying a claim, restricting a Page, dismissing a report, or reversing a takedown; these decisions and creator notifications remain auditable.

Supporter safety and moderation

Creators can mute, block, or report a Page supporter or connected-inbox participant. Muting preserves the interaction for creator review while stopping Loresta AI and automated replies. Blocking also stops normal outbound delivery, revokes current Creator Page conversation access, and carries the last known browser safety fingerprint forward so reopening the ordinary flow does not bypass the control.

Supporters can report a Creator Page or their current Page interaction. Public safety forms and the Page concierge use layered address, Page, and browser-session rate limits plus Turnstile checks. A report stores its reason, a bounded evidence excerpt, a content hash, the relevant interaction identifier, and recorded abuse signals; it does not copy the full conversation into the operator queue.

Authorized operators can investigate, apply proportionate restrictions, dismiss, mark an appeal, and reverse an action. Each transition records the named operator, prior state, evidence-based note, and audit event. A creator or supporter who believes a control is a false positive can contact Loresta support with the report reference; support marks the case appealed, reviews the existing evidence, and restores the prior Page or conversation state when reversal is warranted.

Response and browser controls

Loresta applies a restrictive content security policy, frame restrictions, referrer policy, and permissions policy to web responses. Public API consumers must still protect their own logs, secret stores, network boundaries, and user confirmation flows.

Continue with Data and privacy for retention and export behavior.