Security and privacy
Protect keys and choose safe workflow telemetry.
Flowmark stores the workflow names, steps, context, errors, and result summaries that your application explicitly sends. Treat them as application data, not as anonymous or harmless metadata.
Keep credentials on the right side
- Use the private server-write key only in Node.js or server-only modules.
- Dashboard readers sign in with email and password. A project read key is only for programmatic API queries, not for the dashboard UI.
- Browser keys are public by design and can submit browser telemetry only. They cannot read data or authorize private server writes.
- Configure exact browser origins and rate limits. CORS and origin checks are not user authentication. Treat browser events as untrusted telemetry.
Never place a private key in a NEXT_PUBLIC_* variable, browser config file, or
client bundle.
Choose what to record
Use stable names and small JSON-safe properties. Avoid secrets, credentials,
payment information, request bodies, raw exception objects, stack traces, and
unnecessary personal data. A safe example is { provider: "backup" }; an
order ID can still be personal data in your context and retention model.
Use stable error codes with an optional message that you have reviewed. Do not
send the full error object. Set handled: true when your application recovered.
Workflow properties and results are bounded to depth 5, 128 keys, 128 characters per key, 2,048 characters per string, and 16 KiB encoded per object. Keep payloads well below these limits and send only fields that help investigate the run.
Data ownership and operation
Dashboard sign-in is Better Auth email and password. Retention cleanup and key rotation in the UI are still upcoming. See local development for the current stack.