Powerful code. Clear boundaries.

Know what crosses the boundary.

HubSpot access

Review the permissions shown when connecting your HubSpot portal. Map only the inputs your action needs, and limit any additional credentials to the access required by your code.

Connection and permissions

Stored run data

Run history can include inputs, outputs and console logs. Plan history windows and deletion from logs, stored objects or backups are different controls. Avoid logging secrets or unnecessary personal data.

Data handling and retention

Credentials

Vault secrets are encrypted at rest and made available to authorized executions. Keep credentials out of source code, returned results and log statements.

Secrets and execution context

Testing and publishing

Publishing creates a version of your action. Test before using it in a live workflow. A dry run captures ctx.store writes, but outbound requests made by your code can still have real effects.

What a test run touches