marchon/zapier-user-docs
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

Initial import of zapier-user-docs from zapier monorepo

Browse source
This commit is contained in:
George Lambert 2026-09-11 14:24:14 -04:00
commit 72c4e13c55
16 changed files with 298 additions and 0 deletions
Download patch file Download diff file Expand all files Collapse all files

9
12-security.md Normal file
View file

@ -0,0 +1,9 @@
# 12. Security: what Zapier never sees
- Zapier **never** connects to NATS, tree nodes, WORM archives, or `api.veraetime.net`.
- NS1 `nats-server` stays on **127.0.0.1:4222**. Operators use `scripts/nats-tunnel.sh`; it is not a public bind.
- File bytes and private metadata never go on chain. Private metadata is only on authenticated archive replies.
- API keys are `x-api-key` / Bearer tokens on HTTPS. Treat them like passwords; regenerating kills old Zaps.
- Bloom filters are **not** an access-control list. On a hit, middleware still checks tenant/share before returning private records.
If a trace (simulator or `DEBUG_VERAE`) ever shows a `zapier-platform-app` hop with a `verae.*` subject, that is a bug — do not push the app.