Security Best Practices

Keep endpoint tokens secret, use HTTPS destinations, verify signatures, send idempotency keys, rotate secrets, and use least privilege for BYO database credentials.

Store endpoint tokens and signing secrets in your own secret manager, not in source control or shared notes. Rotate endpoint tokens after vendor changes, accidental exposure, or screenshots that include ingest URLs. Rotate destination signing secrets when receiver ownership changes.

Do not email payload bodies. Use event IDs and dashboard links when coordinating incidents so only users with the right workspace access can inspect sensitive data. For BYO database mode, use the generated least-privilege SQL and avoid reusing an application superuser.