Security principles
AI META ADS applies least privilege, explicit authorization, separation of customer contexts, and traceable operational actions. Security controls are reviewed as the product and connected APIs evolve.
Access and authorization
Desktop access requires an authorized software account. Account validity and device limits are enforced by the authorization service. Meta access requires OAuth approval or customer-owned App credentials and is limited to granted scopes.
Credential handling
Passwords and access tokens are confidential. Platform Meta App configuration is managed by the authorization service. Users should never send passwords, App Secrets, or access tokens by email or support messages.
Transport, updates, and logging
Production endpoints should use HTTPS. Update metadata and packages are delivered through controlled endpoints and downloaded through the desktop local proxy. Runtime logs support diagnosis and accountability but must not be treated as a place to store secrets.
Vulnerability reporting
Report suspected vulnerabilities privately to support@fbadsme.com with the subject “Security Report”. Include affected URL or version, reproduction steps, impact, and safe supporting evidence. Do not access other users’ data or disrupt production services.
Response
We acknowledge credible reports, assess severity, contain risk, implement remediation, and communicate with affected parties when required by law or appropriate to protect users.