Security

Report a security issue

If you find a vulnerability, write to security@mb-suite.com with the steps to reproduce it, the request_id if you have it and the impact you see. Do not test against other organizations' data or degrade anyone's service.

How we protect your credentials and data

• API keys and tokens are stored as hashes: nobody can read them again, MB Suite included. That is why they are shown only once.
• A credential can never do more than the person it represents, and every call is recorded in the audit log under that person's name.
• Revoking an API key or disconnecting an app cuts access instantly: every request verifies the credential again.
• Webhook signing secrets and the values of their static headers are kept in a secrets manager, outside the database.
• Bulk and irreversible operations, and the ones that send something outside MB Suite or have a separate cost, need a separate confirmation outside the screen, and most of what is deleted stays 30 days in the trash.
• Webhooks only go to public servers over https://, without following redirects.

Your side

• Keep API keys as secrets (environment variables, a secrets manager), never in a web page's code or in a repository.
• Give each integration its own API key, with just the modules and permissions it needs, and no deletion if it does not need it.
• Use expiry dates and rotate API keys from time to time; if one is exposed, revoke it.
• Verify every webhook's signature and reject old t values.
• Review from time to time which apps have access, in Settings → API & MCP → MCP.