Ecosystem security protects tenants, publishers, and Tradeics. Review depth scales with visibility, scopes, and monetization.
Principles
- Least privilege scopes.
- Install-scoped credentials only.
- Signed webhooks; reject unsigned events.
- No silent exfiltration of PII.
- Public paid apps get the highest review bar.
Threat checklist
| Risk | Mitigation |
|---|---|
| Scope creep | Re-consent + review on widen |
| Token leak | Rotation, short TTL, secret scanning |
| Abusive metering | Caps, anomaly alerts |
| Malicious listing | Publisher verification, takedown policy |
Builder duties
- Complete security questionnaire for public/write apps.
- Store secrets in Platform or your HSM — never in git.
- Publish a privacy policy URL for public listings.