Security

Small attack surface. Clear permissions. Reversible access.

Security is treated as part of product design, not as a feature added after the workflow is built.

Least privilege

Products should request only the capabilities needed for the task. Where practical, reading, editing, publishing and destructive actions are separated.

Authentication over password sharing

Supported integrations use scoped credentials and authorization flows instead of asking users to hand AI systems a primary website password.

Revocation

Access should be removable without changing the site owner’s core login credentials.

Auditability

Administrative actions should leave enough information for the site owner to understand what happened and when.

Conservative defaults

Higher-risk actions should not be silently bundled into routine content permissions.

Responsible disclosure

If you believe you found a security issue, use the support form and select Security issue. Include enough detail to reproduce the problem without sending passwords or secret keys.