Security

Keep credentials, requests and listing content inside explicit trust boundaries.

Protect keys
Use server-side secret storage and the narrowest scopes.
Log safely
Record request IDs, never credentials or raw personal data.
Report a vulnerability
Use the published security contact and disclosure policy.

Minimum controls

AreaControl
CredentialsNo URLs, browser storage, analytics, screenshots or support messages
TransportHTTPS only; validate the API hostname
ContentTreat job descriptions and source text as untrusted data
AccessReview organisation membership and revoke stale keys
DiagnosticsRedact secrets before logging or sharing a request