Security Best Practices

Pipedream implements a range of privacy and security measures meant to secure resources and protect your data from unauthorized access. But since actions, triggers, and custom tools run code and process data on behalf of your end users, you also have a responsibility to ensure you handle that code and data securely. We’ve outlined a handful of (non-exhaustive) best practices for that below.

​

Store secrets as connected accounts or project secrets

Never store secrets like API keys directly in code. These secrets should be stored in one of two ways:

• If Pipedream integrates with the app, use connected accounts to link your apps / APIs.
• If you need to store credentials for an app Pipedream doesn’t support, or you need to store arbitrary configuration data, use project variables and secrets.

Read more about how Pipedream secures connected accounts and environment variables here.

​

Keep your Pipedream credentials server-side

Your OAuth client ID and secret grant access to the resources in your workspace. Store these credentials securely on your server, never allowing them to be exposed in client-side code, and make Connect API calls from your backend. For anything that runs in your end users’ browsers, use a Connect token or a Connect Link. Both are scoped to a single end user, can only initiate the account connection flow, and are short-lived. Let your users connect their own accounts through managed auth instead of collecting their third-party credentials in your application. Pipedream encrypts and stores the credentials, and you reference the account by ID.

​

Deliver data to and from Pipedream securely

Always send data over HTTPS to Pipedream endpoints. When you connect to APIs through the Connect proxy, or receive events at your own endpoints, encrypt that data in transit by using HTTPS endpoints.

​

Validate webhook signatures

Pipedream signs every trigger webhook delivery with HMAC-SHA256. Validate the x-pd-signature header with your signing key before you process an event, compare signatures with a constant-time function, and reject requests with old timestamps to prevent replay attacks. See validating signatures for Node.js and Python examples. Many third-party apps also pass a signature with event data delivered via webhooks. The signature is an opaque value computed from the incoming event data and a secret that only you and the app know. Signatures are specific to the app sending the data, and the app should provide instructions for signature validation. Not all apps compute signatures, but when they do, you should always verify them. When you deploy a Pipedream trigger, Pipedream verifies the app’s signature for you. You can always audit the code behind the component to confirm this, and suggest further security improvements that you find.

​

Audit the code and packages you use

Pipedream components are just code. Pipedream provides prebuilt triggers and actions that facilitate common use cases, but these are written and run as code, and you can examine them in our GitHub repo. We encourage auditing this code as a best practice. Even code authored by Pipedream can be improved, and if you notice a vulnerability or other issue, you can submit a patch or raise an issue. When you publish a custom tool, you can include any third-party package supported in the runtime. It’s your responsibility to keep these packages up-to-date and review them for vulnerabilities. Before you use a new package, review its page on npm and its repo, if available. Good packages should have recent updates, a healthy number of downloads and related activity (like GitHub stars), and an author who is responsive to issues raised by the community. If you don’t observe these signals, be wary of using the package.

​

Limit what you log

Pipedream does not store or log request payloads or response bodies when your users make requests through Connect via API or MCP. What your own application logs is up to you: if you cannot retain specific data for privacy or security reasons, don’t log the requests you send to Pipedream or the responses you receive, and remove any logging of credentials or end user data from the code you publish as a custom tool.