Security & Privacy
The short version
The architecture is the trust claim.
Your Meta access token goes from your browser directly to Meta's API and back. It never touches my server. I don't have a database. I don't have logs of your ad data. If my site got hacked tomorrow, the attackers would find nothing useful about your ad accounts, because there is nothing to find.
One disclosure for honesty: the site counts anonymous page views via va.vercel-scripts.com (Vercel Analytics). It uses no cookies, no fingerprinting, no PII, and no cross-site tracking. It tells me how many people visited /dashboard last week, nothing about who they are or what data they pulled.
You can verify the data flow yourself in any browser. Open DevTools, switch to the Network tab, paste your token. Your ad data flows only to graph.facebook.com. The only other outbound origins are this site itself and va.vercel-scripts.com for the page-view beacon.
What happens to your Meta token
When you paste your Meta access token into openreport:
- The token is stored in your browser's sessionStorage.
- Your browser sends the token directly to graph.facebook.com to fetch your ad data.
- My server is not involved in this request. It does not see the token. It does not see the data.
- When you close the browser tab, sessionStorage is wiped. The token is gone.
You can verify the same flow yourself. Open your browser's DevTools, go to the Network tab, and paste a token. Every network call goes to graph.facebook.com or the openreport domain for page loads. There is no hidden third-party request, no background ping, no analytics beacon.
If you spot a request that goes anywhere else, that's a bug. Email me at sdhilip@alloy-analytics.com and I'll fix it.
What I store
Nothing.
- No database
- No user accounts
- No session cookies beyond what Next.js needs for page routing
- No server-side logs of user activity
- No analytics (Google Analytics, Plausible, Mixpanel — none of them)
- No error tracking services (Sentry, Rollbar — none of them)
- No CDN that logs your requests beyond what Vercel's edge network does by default
I made this choice on purpose. Storing less means there is less to leak.
What Vercel knows about you
I host the public version of openreport on Vercel. Vercel is the hosting provider, similar to how a website runs on AWS or Google Cloud.
- Your IP address when you visit the site
- The pages you load
- Basic request metadata (browser, device type)
- Your Meta access token
- Your ad data
- Anything you type into the app
Vercel's data retention is governed by their own privacy policy: vercel.com/legal/privacy-policy.
What I recommend you do to stay safe
Only grant ads_read permission when you generate your Meta token
openreport only reads your ad data. It cannot pause campaigns, change budgets, or create ads. When you generate a Meta access token, do not grant ads_management or any write permission. If you do grant write access by mistake, a leaked token could let someone modify your campaigns. Stick to ads_read.
Use short-lived User Access Tokens for casual use
For testing or occasional use, use a User Access Token. These expire in 1-2 hours. Even if something goes wrong, the risk window is small. For regular use, generate a System User token (permanent). Only do this once you're comfortable with the tool. Full instructions in the setup guide.
Revoke access when you stop using the tool
Go to Meta Business Settings → Business Integrations (or the Apps tab in your developer account), find the app you used to generate the token, and remove it. Takes 10 seconds. Direct link.
Be careful about the URL
openreport is hosted at one official URL. If you land on a site that looks like openreport but has a different URL, close the tab. I will never ask you to enter your token anywhere other than the official URL.
What could go wrong
I'm going to be direct about realistic risks instead of pretending there are none.
Your own device is compromised
If someone installs malware on your computer, they can read your browser's sessionStorage. This would let them steal your token. This risk exists regardless of which app you use — openreport, AgencyAnalytics, any of them. It's your device, not the app.
The hosted openreport site gets compromised
If someone breaks into my Vercel account, they could potentially push malicious code that steals tokens from users. This is the most serious risk.
- I use a strong password and 2FA on all my accounts
- I use short-lived deployment credentials and rotate them regularly
- The DevTools network tab will show any new outbound destination on first page load — if you ever see a request to a domain that isn't graph.facebook.com, this app's origin, or va.vercel-scripts.com, stop using the tool and email me
Meta's API has a vulnerability
Out of scope for any tool. If Meta has a security issue, we all have it.
You paste your token into a phishing site that looks like openreport
Always check the URL. The real openreport lives at the official domain. Nowhere else. If someone sends you a link to a different domain claiming to be openreport, it is not me.
What happens if something goes wrong
If you suspect your token has been compromised:
- Revoke it immediately: facebook.com/settings?tab=business_tools
- Check your Meta Ads Manager for any unexpected activity
- Email me: sdhilip@alloy-analytics.com
If you find a security issue in openreport: Email me directly at sdhilip@alloy-analytics.com. I will respond within 48 hours for critical issues.
I don't have a bug bounty program because this is a free project with no revenue. But I will credit you publicly and I will fix the issue fast.
What this page does not say
This page does not say openreport is "100% secure" or "bank-grade" or any of the other phrases that security-aware people immediately distrust. Nothing is 100% secure. What I can say is:
- I've tried to build the simplest possible architecture that minimizes the places your data can leak
- Every request is observable in your browser's DevTools network tab — no hidden traffic
- The token never leaves your browser except to call Meta directly
- I will tell you the truth about risks, including the ones that are inconvenient for me
That's the trust model. If it doesn't work for your situation, don't use the tool. That's fine.
Contact
- Email: sdhilip@alloy-analytics.com
- X: @sdhilip