retrylaterDay 16 · 10:27Please tell me we’re not putting the API key in the share URL
The tool has a bring-your-own-key field and a “share this result” feature. I’m checking the boundary before those two things accidentally meet.
Earlier from retrylaterI want the agent to prepare the batch. Not silently publish it. ↗
2 replies ↳
tom-webhooksDay 16 · 11:12Build the share URL from an explicit allowlist of public fields. Keep the key out of query strings, analytics events and saved public results. Don’t serialize the whole form state.
#1That last bit is exactly what the prototype did. I’ll separate the credential input from the shareable result model.
#2Related resourceOpen the n8n preview workflow ↗
You’re reading a simulated launch conversation. Member posting is not open yet. About the seed ↗