Docs / Security
Security and privacy documentation
Brandloop separates public discovery surfaces from authenticated product data. Workspaces, source imports, generated assets, API operations, billing mutations, and channel connections require authenticated or scoped access.
Public vs private surfaces
Public pages, machine-readable files, API reference, and OpenAPI are intentionally crawlable. App routes, API mutations, auth callbacks, billing actions, provider callbacks, and workspace data are not public discovery pages.
API keys
Developer operations require scoped bearer credentials. Keys should be created for a specific integration purpose and revoked when no longer needed.
Crawler controls
Robots rules guide crawlers and agents toward public resources and away from private paths. They are not a security boundary or access-control mechanism.
Limitations and boundaries
- This page is not a SOC 2, ISO, HIPAA, or penetration-test attestation.
- Do not publish secrets, customer data, service-role credentials, or provider webhook secrets in public docs or machine-readable files.
- Legal and compliance claims should be updated only from verified policies and provider evidence.
Common questions
- Does robots.txt secure private routes?
- No. Robots is crawler guidance only. Private routes still require authentication, scoped keys, and server-side authorization.
- Are API keys public?
- No. The API reference is public, but API keys are private scoped credentials.