Security and Governance v1

Apply least-privilege Site and Environment access, keep credentials in Connections, and scope API Keys to the required Workflows and consumers. Use revision history, Release Management, Workflow Logs, relationships, and audit trails as operational evidence.

Workflow execution

Review Start Node and Workflow settings before publishing Run Now, schedules, listeners, HTTP endpoints, or MCP tools. Test authorization and launch behavior in the target Environment.

DropPoints and private access

Install DropPoints only on managed hosts with the required private-system access. Protect the host, service credentials, certificate trust, and outbound connection to Flowgear. Keep each Node's DropPoint placement and Connection configuration aligned with the intended network boundary.

Published interfaces

Use Token API Keys for service clients and Cookie-based access only for supported signed-in user scenarios. Treat caller input as untrusted, validate it before side effects, and avoid writing secrets or unnecessary personal data to Workflow Logs.

See API Key, Create a Connection, and Different Ways to Run a Workflow.