Integration security

Required controls

• Keep API keys and OAuth client secrets on the server.
• Use the smallest provider scopes that satisfy the workflow.
• Rotate and revoke credentials when ownership changes.
• Validate webhook signatures and destination safety.
• Do not include tokens or personal data in client logs.