Keys & data safety
Where to keep API keys for your app, which keys are safe in the browser, and what MeDo does and does not check for you.
Most real incidents in small apps come from one of two mistakes: a key that should have stayed on the server, or data that anyone can read because no rule was set. This page covers both.
Keep credentials in Secrets, never in your pages
Any API key, token, or password your app needs goes in the Secrets panel of the Backend view (see App Secrets), or in the credential form MeDo shows in the conversation when a Skill needs one.
- Values are stored on your app's backend — a key you save for one app is not shared with another, unless those apps share a backend.
- Values are masked when displayed again, so you cannot read them back out of the interface.
- Copying an app does not copy its credentials. Configure them again in the copy.
Never paste a key into page content, into a prompt asking MeDo to "put this key in the code", or into anything a visitor can view.
Two kinds of key, two different rules
This is why Managing access & roles matters: with a public key in the browser, your rules are the protection.
Downloading your source
When you download your project, MeDo removes the service key from the project's root .env so it does not travel with the archive. The public URL and public key remain, which is what a local run needs.
Two things to remember:
- Replace those values with your own project's when you self-host, otherwise your local copy still talks to the hosted backend.
- Treat the archive as sensitive anyway — it contains your database structure, your rules, and your functions.
Content policy and suspension
Published apps must follow the content policy. An app that violates it can be suspended, and it then shows as unavailable to visitors. When this happens the reason is shown in the publish panel, along with a link to the policy and a Request manual review button if you believe it was a mistake.
What MeDo does not do for you
Be clear about the boundary so you do not assume coverage you do not have:
- No security scan. MeDo does not scan your app for vulnerabilities, exposed tables, missing access rules, or leaked keys, and does not produce a security report.
- No penetration testing and no compliance certification of your app.
- Quality analysis is not a security check. It verifies functionality and console errors; it does not attempt unauthorized access. See Testing with AI Quality Analysis.
A short checklist before launch
- Every credential is in Secrets, none in page content.
- The service key is not referenced anywhere in the frontend.
- You asked for access rules, and you verified them with two test accounts.
- You signed in as a second user and confirmed you cannot see the first user's records.
- Sensitive fields — phone numbers, addresses, notes — are only returned to the people who should see them.