Core principles
- Use separate credentials for people and systems.
- Rotate API and webhook secrets when team ownership changes.
- Document which routes are sensitive and who can access them.
Minimum secure baseline
Bearer tokens in environment variables, HTTPS-only callback delivery, and a small admin group already remove most avoidable operational risk.