How a request is protected, layer by layer
From the moment a module is submitted to the moment it calls an external API — every stage has a real, enforced check.
Submission
Every marketplace module is statically scanned before approval — eval/filesystem/child_process access, hardcoded secrets, and obfuscated payloads block approval outright.
Install
Plan and capability gates are re-checked at install time — a module can't run on a workspace it isn't entitled to.
Execution
A per-request sandbox re-checks the plan, install status, and payload size, and enforces the module's declared permission boundary on every API call.
Network
Outbound connector calls are checked against an approved-domain allowlist and reject private/loopback ranges — the same SSRF guard used across every connector.
Audit
Privileged actions are logged outside module scope, so a module can never suppress its own audit trail.
Security
Security Built Into Every Layer
Real, shipped defenses — no compliance badges we haven't earned.
Workspace-Scoped RBAC
Every action checked against workspace and organization roles before it runs.
Encrypted Credentials
Connector and channel credentials are encrypted at rest, never exposed to module code.
Static Security Scanning
Every module is scanned before approval — blocked patterns include eval, filesystem access, and hardcoded secrets.
SSRF Guards
Outbound connector calls are checked against an approved-domain allowlist and reject private/loopback ranges.
2FA / TOTP
Optional two-factor authentication with lockout protection on the credentials login.
Full Audit Trail
Every privileged action — tags, role changes, module installs — is logged and reviewable.