Credential isolation
Application secrets and tokens are stored outside the public website and are not embedded in browser-delivered code.
Security
Public information, private credentials.
The Ark Century website is intentionally separated from the advertising runtime. It contains no advertising database, platform token, application secret, or public sign-in flow.
Least privilege
Only permissions needed for authorized advertising operations are requested and used.
Auditability
Sources, evaluations, recommendations, approvals, and outcomes are recorded for review.
Approval boundaries
Configured limits prevent exceptional actions from proceeding without human review.
Retention controls
Operational records follow defined retention periods and deletion procedures.
Observation mode
Read-only collection and evaluation can be verified before advertising changes are enabled.
Authorization boundary
OAuth completes on the operator's device.
The MVP callback listens only on the local loopback interface. It validates a short-lived, single-use state value before exchanging the authorization code.
- 1Start locally
The operator initiates authorization from the local application.
- 2Authorize with the platform
The platform presents and records the permissions being granted.
- 3Validate once
The local callback validates state and consumes the authorization code once.
- 4Store securely
Credentials remain in Windows-protected local storage and are redacted from logs.
Report a security concern
Send a reproducible description, not sensitive credentials.
Email security@arkcentury.top with the affected URL, observed behavior, and safe reproduction steps. Never include passwords, tokens, or personal identity documents.