Data isolation
Production workspaces are designed around organization membership and project-scoped authorization. Database row-level policies enforce tenant boundaries.
Credentials
Provider secrets belong in encrypted server-side configuration, never browser storage. OAuth tokens and webhook secrets are restricted to the workflows that require them.
Action safety
Sending, publishing, billing, and provider imports require an authorized connection. Material results create receipts so a displayed success can be reconciled with the external provider.
Reporting
Report suspected vulnerabilities privately to security@demandbolt.com. Do not access or alter data that is not yours.