Home Security
Security pages are usually adjectives. This one is mechanisms: what is hashed with what, which cookie flags are set, where keys live and what is checked on every request.
Passwords are hashed with scrypt using a per-user random salt and deliberately expensive parameters (N=32768, r=8, p=3). Older hashes are upgraded automatically after a successful login. Verification uses a constant-time comparison.
A session is a 256-bit random token in an HttpOnly, SameSite=Lax cookie, marked Secure in production. JavaScript on the page cannot read it, which removes the most common route from a script injection to a stolen account.
Every protected endpoint resolves the session to a user and then verifies that the requested channel, scan or package belongs to that user. Isolation is enforced per request rather than assumed from the UI.
AI provider keys, YouTube OAuth tokens and 2FA secrets are encrypted at rest with AES-256-GCM and used only server-side. The browser is told which provider is selected, never the key. Environment-provided keys take precedence over stored ones.
If a feed or a provider call fails, the scan completes with what it has and reports exactly what failed. You are never shown a thinner result that looks complete.
Cached scans expire after 24 hours automatically. Saved packages persist until you delete them, and deleting a channel removes its associated data.
A few things are outside our control and worth getting right on your side:
If you run VidiScoop on your own infrastructure, the security properties described above are the application’s. Everything below the application — the host, TLS termination, backups, network access and OS patching — is yours. In particular, set both CRON_SECRET and SETTINGS_ENCRYPTION_KEY before enabling scheduled jobs or saving credentials.
No. Every account has its own workspace and every protected request verifies ownership of the resource before returning it. Channels, cached scans, saved packages and provider settings are all scoped to the account that created them.
No. Keys are written to the server-side store and read only by server-side code when making a provider call. API responses about your settings include which provider is selected and whether a key is present, never the key value itself.
The channel and the data associated with it are removed. Cached scans expire on their own within 24 hours regardless, and saved packages can be deleted individually at any time.
No. When you supply your own provider key, requests go to your provider account under that provider’s terms — which is one of the reasons the bring-your-own-key model is the default. Nothing is used for training by us.
Email the security details to our support address with steps to reproduce. Please report privately rather than publicly first, and we will confirm receipt and keep you updated on the fix.
Create an account and everything inside it — channels, research history, packages and keys — is isolated to you.
No credit card required · Your first ranked scan takes about a minute
VidiScoop