Security

Keys and access¶

1. Enter bot tokens and AI keys only in their dedicated fields.
2. Never insert them into prompts, messages, tables or generator requests.
3. Hide secrets and personal information before sharing screenshots.
4. If a key is exposed, revoke it with the provider and connect a new one.

User input does not grant permission¶

Before deleting data, granting rights or sending to another chat, check the author and their access to the object. An AI answer is not proof of a user's authority.

Grant bots and integrations only the permissions they need. Store minimal personal data and decide when it should be deleted.

Shared and personal data¶

Bot variables are shared across chats. Chat scope is shared by members of a group chat, not private to each person. For personal records, use a table with a user ID column and filter by it.