Security
Ethio Viral is intentionally small on the client and strict on the server. Below is how the pieces fit together.
The Meta OAuth flow — state, PKCE, code exchange, encrypted token storage — is handled by our VPS backend. The browser never sees or stores Meta access tokens, app secrets, or long-lived credentials.
Your session lives in a Secure, HttpOnly `meta_session` cookie set by the backend. The frontend cannot read it; XSS cannot exfiltrate it. Every request uses credentials: "include" so the cookie rides along the same-origin call.
The browser only calls the configured API origin. Cross-origin calls to graph.facebook.com or any third party from the frontend are blocked by design.
Create, update, and pause tools require an explicit human approval step. The first tool call returns a short-lived confirmation token; the second call replays the exact arguments with that token. No optimistic writes, no auto-retry on ambiguous failures.
Campaigns are always created PAUSED. Ad set and ad creation are intentionally not exposed. There is no delete tool. Read tools return only what the connected Meta user can already see.
It is maintained by the app owner to answer common security and privacy questions. It is not a certification and it does not guarantee compliance with any specific regulation.
Have a security question? See the documentation or reach out to the app owner.