Security

No passwords for your social accounts

ReplyMan never asks for your X, Reddit or LinkedIn password, and installs nothing in your browser. You post each approved reply on those sites yourself. We only store your username so we can recognise your posted replies. For Bluesky you sign in with Bluesky itself, so we never see your password, and the access only lets ReplyMan create posts. You can revoke it at any time from your Bluesky account.

Encrypted credentials

Bluesky sign-in tokens, app passwords and other connection secrets are encrypted before they are stored, with AES-256-GCM. Each secret has its own key, which is itself encrypted with a master key kept outside the database.

Sign-in

• You sign in with Google or with a link we email you. We store no password for your ReplyMan account.
• Emailed links work once and expire after 5 minutes.
• Repeated sign-in attempts from the same address are rate-limited.
• Session cookies are marked HttpOnly and Secure, so scripts cannot read them and they only travel over HTTPS.

Infrastructure

• All traffic uses HTTPS.
• ReplyMan runs on Cloudflare. The server that holds your data is not reachable from the internet; only our web app can call it.
• Every request is checked against your session and workspace, so one workspace cannot read another's data.

You stay in control

Agents only draft. Nothing is posted until you approve it, and on X, Reddit and LinkedIn nothing is posted until you press Post on the site yourself.

Reporting a vulnerability

If you think you have found a security issue, email hello@replyman.app with the details and steps to reproduce it. Please give us a chance to fix it before telling anyone else, and do not access other people's data or disrupt the service while testing. We will reply and keep you updated.