Security

Account Management

Role-based access control with three roles (viewer, operator, admin). Organization-scoped user management. OAuth-based account provisioning.

Access Enforcement

Every query filters by organizationId for multi-tenant isolation. The requireOrgAdmin helper guards admin-only API routes, confirming the admin role against the database on every request. requireAuth() on all protected endpoints.

Unsuccessful Logon Attempts

Sign-in is OAuth 2.0 through Meta only: Formation Ads stores no password, so there is no local password to guess, and Meta applies its own limits to the Facebook login. The one credential Formation Ads checks itself, the multi-factor authentication code, is limited to 3 attempts per 5 minutes per user, then blocked for 1 hour. The counter lives in the database, so it persists across serverless cold starts. Authenticator codes are single-use and backup codes are consumed on use.

Session Termination

30-minute inactivity timeout. Activity timestamp (lastActivityAt) updated on every authenticated request via JWT callback. Session automatically terminated and user redirected to login after 30 minutes of inactivity. 5-minute warning displayed before timeout. Exempt paths: /verify-mfa and /setup-mfa.

Audit Events

Append-only audit_logs table records every mutation with userId, orgId, entityType, action, and metadata; database triggers (migration 0047) refuse UPDATE, DELETE and TRUNCATE, and a daily check alerts if they are missing, disabled or no longer match the migration's definition. Structured JSON logging via Pino with 50+ sensitive field redaction patterns.

Least Functionality

36 production dependencies, no unnecessary services. No AI/LLM integrations. No global state management library. Server components as default. Content Security Policy restricts resource loading.

Multi-Factor Authentication

TOTP authenticator app with HMAC-SHA256 hashed backup codes. Enabled by each user in Settings; an organization admin can require it for every member, after which the member is held at MFA setup until enrolled.

Authenticator Management

AES-256-GCM encrypted MFA secrets with PBKDF2 key derivation. Per-deployment encryption salt. OAuth tokens encrypted at rest.

Transmission Confidentiality

TLS 1.2+ enforced on all connections via Vercel edge network. HSTS with 2-year max-age, includeSubDomains, and preload directive.

Cryptographic Protection

AES-256-GCM for Meta token encryption. PBKDF2 key derivation with per-deployment salt. HMAC-SHA256 for cron authentication and backup code hashing.

Protection of Information at Rest

Meta access tokens and page tokens encrypted with AES-256-GCM before database storage. Per-deployment ENCRYPTION_SALT prevents cross-environment decryption.

System Monitoring

Sentry captures server and client errors with session replays and source maps. Pino structured JSON logging with 50+ sensitive field redaction patterns. Scheduled jobs record a heartbeat per execution; a job that misses a delivered scheduler tick, fails, or starts without finishing raises an operator alert, so a silently-dead job is detected rather than assumed healthy. Stuck publish jobs are requeued by a recovery job on the same schedule. Dispute webhook alerts.