Security

#Report an issue

Email destek@upvera.co with the details and the steps to reproduce. Write in English or Turkish. Please give us a reasonable time to fix the issue before you share it publicly. The same contact is in /.well-known/security.txt.

#MCP server

• Upvera runs its own OAuth 2.1 authorization server for MCP. An AI client never receives your Upvera session, so it cannot change your password or act outside its scopes.
• Tokens are opaque and bound to https://mcp.upvera.co/mcp. Access tokens live one hour; refresh tokens live 30 days and rotate on every use.
• Every connection is listed in Settings › Security › AI access. Revoking one ends its tokens at once.
• Tools read only the signed-in account's own data, never touch money and never read direct messages. The model cannot publish: publish_post is visible only to the preview card, needs a permission you turn on yourself at connect time, and checks a one-time ticket and a content hash on Upvera's side. Writes are drafts and previews until you press Publish.
• The MCP server holds no database administrator key. It reaches data through narrow, signed calls.

#Sign in with Upvera

• Authorization code flow with PKCE S256, nonce and state required, iss returned in the response.
• ID tokens are ES256-signed with rotating keys. Codes live 60 seconds and work once.
• Each site gets its own pairwise subject, so two sites cannot link the same person by ID. Email is off by default.

#Data you can check yourself

Every day is sealed into a root and published to upvera-co/ledger-roots with an OpenTimestamps proof. See Verify a day.

#Transport

Every Upvera address is HTTPS only. .dev domains are on the browser HSTS preload list, so upvera.dev never loads over plain HTTP.