Security

Identity protection

• Verify the email address used to accept an invitation.
• Use a passkey or authenticator-based two-factor authentication for privileged roles.
• Store recovery codes privately; each recovery code is single use.
• Review active sessions and revoke devices you no longer use.
• Expect recent strong authentication for sensitive ownership and billing changes.

Permission boundaries

Owners control organizational ownership, privileged grants, app transfer, deletion, and closure. Admins and developers can manage application files and keys. Billing members manage payments and plans without file-content access. Viewers see metadata.

The backend rechecks organization membership and permissions on every request. Hiding a dashboard button is a convenience, not an authorization boundary.

Credential hygiene

Store application tokens and Stripe credentials only in server secret stores. Use independent scoped keys per integration. Rotate keys after exposure or an application transfer.

Keep signed download URLs, upload destinations, callback signatures, and recovery codes out of analytics and support logs. Restrict callback URLs to approved destinations and validate callback signatures before processing events.