Handling secrets
Never paste a password, a key or a code in Messages or in a file. Each has a right place.
A Teammate reads everything in Messages and in the Library outside private/, and History keeps it.
| Secret | Where it goes |
|---|---|
| A website password | Login Assistant, in the secure form |
| A one-time code | In the thread, when Login Assistant asks |
| A service you use | Apps, connected in Settings |
| A personal note | private/ |
If a secret slipped in, rotate it on the service: deleting the message or the file isn’t enough.
Webhook links
Section titled “Webhook links”A Webhook link lets anyone who has it message that Project. Put it only where it’s needed — the one automation that should call it — never in a shared document or a public page. If it leaks, revoke it in Webhooks and create a new one. Prefer one Webhook per caller: revoking one never breaks the others.