Security
How Flung protects the accounts, tokens and posts it holds, and how to report a security problem. It describes what the service does today, not plans.
Last updated: 2026-10-31
TL;DR
| Question | Answer |
|---|---|
| Who runs Flung? | Buun Group Pty Ltd, ABN 75 687 193 675, Spring Mountain, QLD 4300, Australia. |
| Where does it run? | On Cloudflare's network: the API, the apps, the database, the files and the background work. |
| Is data encrypted? | Yes, in transit with TLS on every connection. At rest, platform tokens and other secrets are encrypted by Flung with a key for each environment, on top of the encryption Cloudflare applies to its storage. |
| How do people sign in? | With a single-use code emailed to them, or with Google or GitHub. There are no Flung passwords. |
| Is there a record of changes? | Yes. Each workspace has an activity log, and every action Flung staff take is logged with a reason. |
| Is data backed up? | The database keeps a restore history, so it can be put back to an earlier point. |
| How do I report a problem? | Privately, as reporting a security problem says. Please do not open a public issue. |
Infrastructure
Flung runs entirely on Cloudflare: the API, the portal, the staff console, the MCP server and these docs run as Cloudflare Workers, the database is Cloudflare D1, files are in Cloudflare R2, and scheduled posts run in Durable Objects and Workflows. There are no servers of Flung's own to patch or expose. Cloudflare's network sits in front of every request, and its certifications are listed on Cloudflare's trust hub (opens in a new tab). The subprocessors page lists every provider that handles data for Flung.
Preview and production are separate: each has its own database, its own files, its own encryption key and its own secrets, so a preview build can never read production data.
Encryption
| What | How |
|---|---|
| In transit | Every Flung address is served over HTTPS (TLS). Sign-in cookies are marked Secure, so a browser sends them only over HTTPS. |
| Platform tokens | Each connected account's access token, refresh token and the other secrets a platform needs are encrypted with AES-256-GCM before they are stored, with a key derived for each value from the environment's encryption key. That key is held as a Worker secret, apart from the database, and is different in each environment. |
| Other secrets | Webhook signing secrets, the tokens of a connected Plotwork account, and the provider credentials staff set in the staff console are encrypted the same way. |
| Stored as hashes only | API keys (SHA-256), session cookies and sign-in codes. Flung cannot show a key again after it is made, and a copy of the database would not let anyone sign in. |
| At rest | Cloudflare encrypts the database and the stored files at rest, under Cloudflare's own keys. |
Sign-in and access
| Control | What it does |
|---|---|
| Emailed codes | A 6-digit code that works once, for 10 minutes, with a limit on wrong tries and on repeated requests. |
| Google and GitHub | A person can continue with Google or GitHub instead. The sign-in is tied to the browser that started it, and Flung keeps no Google or GitHub token. |
| Sessions | A cookie scripts cannot read, bound to the API's own address, for 7 days and never extended. Signing out ends it on the server. |
| Cloudflare Turnstile | Checks that a person, not a program, is signing in, approving an app, or deleting an account or a workspace. |
| Private beta | While Flung is in private beta, only approved addresses can sign in. |
| Workspace roles | Every workspace's data is reachable only with that workspace's credentials. Only owners can manage billing, see invoices and receipts, or delete the workspace. |
| API keys | Each key acts for one workspace and can expire. A revoked key stops working at once. Keys belong on servers: a page that shows the connect panel gets a short-lived connect token, signed by Flung, for its own address. |
| Apps and agents | An app or AI agent signs in with OAuth and PKCE, gets tokens for the one workspace a person chose, and can be disconnected in the portal at any time. An access token lasts an hour. |
| Rate limits | Requests are limited per key and per app, by plan, and sign-in is limited per address. |
| Webhooks | Every event is signed under the Standard Webhooks scheme, so a workspace's server can check it came from Flung. |
Staff access
Flung staff run the service from a staff console that only one approved address can sign in to, with an emailed code and the Turnstile check, for sessions of 8 hours. The console never shows a token, a key's secret part, a webhook secret or a post's media. Every change made from it needs a typed reason and is written to the staff log, which holds ids, never an address, a token or a key.
Audit logs
| Log | What it records | Who sees it |
|---|---|---|
| The workspace's activity log | Posts, accounts, webhook deliveries, endpoint changes, API keys and members, with who made each change: a person in the portal, an API key, or an app a person approved | Every member, on the portal's Activity page |
| The staff log | Each action Flung staff take, with the time, what it was about, the reason and the outcome | Flung staff |
| Request logs | Each request to the service, with its address, status and timing | Flung staff, through Cloudflare |
Backups and recovery
The database uses Cloudflare D1's Time Travel, which can restore it to any minute within its retention window. Flung runs on Cloudflare's Workers Free plan today, where that window is 7 days; on the Workers Paid plan it becomes 30 days. A deleted workspace can also be restored by its owner for 14 days before it is removed for good. Stored files are kept in Cloudflare R2, which Cloudflare stores durably; Flung keeps no second copy of them.
Error reporting
Where error reporting is set up, faults are sent to Sentry with email addresses, tokens, keys, codes, cookies, request bodies and queries removed first, and with no user attached. Session recording is never turned on.
Reporting a security problem
Report a vulnerability in the Flung API, the MCP server, the SDKs or the apps privately, through "Report a vulnerability" on the Security tab of the flung-mcp repository (opens in a new tab) on GitHub. If you cannot use GitHub, write to legal@buungroup.com (opens in a new tab) with "Security" in the subject. Do not open a public issue.
| Step | What to expect |
|---|---|
| What to send | What you found, how to reproduce it, and what it lets someone do. |
| Our answer | Within three working days, then word when it is fixed. |
| Your testing | Test only against workspaces and accounts that are yours. Do not run automated scans that send large volumes of requests, try to reach other people's data, or test the platforms Flung posts to. |
| Good faith | We will not take action against research done in good faith within these rules. |
See also
| Page | Why |
|---|---|
| Subprocessors | Every provider that handles data for Flung |
| Data processing addendum | The security duties Flung takes on for a workspace's data |
| Privacy policy | What is collected, why, and for how long |
| Cookie policy | The sign-in cookies and the rest of the browser storage |
| Acceptable use policy | What Flung may not be used for |
| Terms of service | The agreement to use Flung |
| Data deletion | Every way to delete your data |
| Authentication | API keys, app sign-in and connect tokens |