Security.
Clear expectations.
Practical security boundaries and responsible reporting.
Account and workspace access
Use appropriate workspace roles and protect access to the identity provider used for sign-in. Review team membership when responsibilities change.
Credentials have different purposes
REST API keys, host tokens, log tokens and private heartbeat addresses are separate credentials. Restrict their use and rotate or revoke them if exposed.
What to send
Do not send passwords, payment details or unnecessary personal data in logs or support messages. Public monitor targets and status-page updates should only expose information you intend to share.
Report a concern
Use Support with a redacted description, affected path and reproduction steps. Do not exploit an issue beyond what is needed to demonstrate it, access another account or include live secrets in a report.
Scope of this overview
This is a description of practical controls, not a certification, audit report or uptime guarantee. Formal security and compliance commitments must be confirmed by the operator.