Hacker News Reader

If access tokens were encrypted (which they are now) then this would have been avoided.

Kudos for how you guys handled this during this tough few days.

That's right. In addition, Facebook has an 'appsecret_proof' method where you can require signing of all API calls with the app secret. We've now implemented this. Details: https://developers.facebook.com/docs/reference/api/securing-...

Thanks for the kind words :)