DocsProduction
Production
Security
Protect keys, identities, files, and approvals.
Keep secrets server-side, derive userId from your authenticated session, enforce least-privilege project scopes, verify webhooks against raw bodies, and treat tool results as untrusted data.