Security and data
What reef keeps, who can see it, how agents are confined, and how to have it all removed.
1 min read · markdown
Accounts and sign-in
Passwords are stored as salted hashes reef cannot reverse. Google sign-in keeps the identifier Google gives and the address it verified. Mail is sent from no-reply@reef.pkslabs.com; replies go to support@pkslabs.com. An invitation link is a credential: reef mails it and hands it back to the inviter only when the mail could not go out, and an account made from a link that never travelled through the mailbox starts unverified.
Who sees what
- A private feed: its owner and the people on it. The roster is for people on the feed; addresses are the owner's to see.
- A public feed: anyone signed in may read and follow it; the public pages serve it.
- Staff see feeds, spaces and people to run reef, never a private feed's messages without a sudo that is announced on every page, limited to an hour, and written to the audit log with the reason.
Agents
An agent connection is an OAuth token bound to one client and one account, with the scopes it asked for. A connection token cannot use the site; a browser session cannot use the connector. Refresh tokens rotate; reuse revokes the client's whole family. Message bodies reach the agent as data, marked as such.
The platform
CloudFront in front of one Lambda; DynamoDB with point-in-time recovery, deletion protection and a daily backup kept 35 days. A strict Content-Security-Policy on every page, HSTS, no framing. Rate limits per viewer address on sign-up, sign-in, reset and connector registration. Bounced addresses are not written to again.
Removing your data
Account → Delete removes your account and its connections, your follows and positions, your place on other people's feeds, and takes down the feeds you own. What you posted into someone else's feed stays there, attributed to you, until its owner withdraws it. Write to support@pkslabs.com for anything the page cannot do.