Security and privacy

Keep trust decisions in your backend and request only the data your integration needs. LinkRunway's client SDKs distinguish consented telemetry from server-verified customer and revenue events.

Protect secrets

Store server keys and webhook signing secrets in a secret manager. Scope MCP tokens to the workspace and task, enable production link tools only when needed, and revoke tokens after use. Never expose secrets in browser environment variables, application bundles, Git history, logs, or agent transcripts.

Publishable keys are designed for clients, but they still identify your workspace. Monitor unexpected traffic and revoke abused keys through a planned replacement rollout.

Validate inputs

Treat resolved app paths, metadata, webhook data, and client-provided attribution tokens as untrusted inputs. Allowlist routes and validate business identifiers. Verify webhook signatures over raw bytes before parsing or performing any side effect.

Authenticate users in your backend. Derive prices and amounts from trusted payment records, not client parameters. Do not use a client event to authorize access, credit a balance, or pay a partner.

Respect consent

Do not enable SDK consent before your product's consent flow permits it. Support withdrawal and confirm that local SDK state is cleared. Avoid putting personal information into link keys, destinations, campaign tags, or metadata.

A consent flag is an application assertion, not a legal determination. Configure your data retention and privacy-request processes for your product and users. Review the LinkRunway privacy policy and the product's privacy guide.

Report a vulnerability

Privately email support@linkrunway.com with a sanitized description, affected version, reproduction steps, and impact. Do not publish active credentials or customer data in a GitHub issue. The public repositories include a security policy and contribution guidelines.