Authorization is separate from proof.

Private drafts, jobs, usage and the 𝕏 connection belong to the signed-in user. Manually entering an account identity does not grant permission to publish for that account.

𝕏 tokens are stored encrypted and are not exposed to the interface. Disconnecting stops local use and renewal of the token; the result of revocation on 𝕏 is shown separately.

Current permission, account/topic/action stop settings and publication history are checked again immediately before sending. A durable sending marker is kept for each submission. An uncertain remote result is not automatically sent again.

There are no automatic likes or DMs. A reply requires official proof that the target author called the connected account. Unknown publishing permission stays off.

If you find a vulnerability, first ask the project maintainer for a private reporting channel. Do not include tokens, session cookies, private drafts or working exploit details in a public issue.

Share the affected version, expected permission boundary and local reproduction steps that contain no personal data. Clearly distinguish a local fixture result from a real remote result. The repository's SECURITY file describes the reporting process.