Security and access

Use the smallest permission

Separate project administration, deployment, and secret access where possible. A user who needs to inspect a deployment does not automatically need to read production credentials.

Rotate compromised tokens

1. Revoke the exposed token.
2. Create a replacement with the minimum required scope.
3. Update CI or the affected integration.
4. Review audit events for unexpected use during the exposure window.

Share logs safely

Before sending a log bundle to support or a community channel, remove access tokens, cookie values, authorization headers, payment data, and personal information.

Incident notifications

Subscribe the appropriate operations and security contacts to relevant notifications. The right owner should be reachable even when the primary project maintainer is unavailable.