Security
Protect accounts, data, credentials, embeds, and integrations.
Protect accounts, data, credentials, embeds, and integrations.
Account access#
Use a unique password, protect the email account used for recovery, end sessions you do not recognize, and limit who can access production sites.
Verify the account email from the link sent after registration. Password accounts can use Forgot password on the login page; a successful reset revokes existing sessions. Account settings can change a local password, link Google explicitly when enabled, and sign out every device. OAuth-only accounts do not have a local password to change, and a normal login never silently links a new identity.
Secrets#
API keys, connector tokens, app secrets, webhook secrets, and voice-provider keys are credentials. Store them in an approved secret manager, never in client code, and rotate after exposure.
Least privilege#
Choose narrow API scopes, dedicated external-platform apps, precise embed origins, and separate keys for separate systems. Remove unused credentials and integrations.
Content and privacy#
Upload only data the agent is permitted to use. Test refusals and escalation paths, and apply retention rules to conversation and lead exports.
Reporting#
When reporting a suspected vulnerability, include the affected URL or component, impact, and reproduction steps without accessing other users' data.