Clear boundaries for project data.

Last updated October 2026

Access

Developer keys map to one workspace and are read-only unless workspace write access is explicitly granted. Keys can be revoked independently.

Isolation

Every private data operation includes the authenticated workspace identifier. Public catalog records are separate and read-only.

Service design

Sourcefolio does not require arbitrary code execution, browser automation, payment data, or access to source-control accounts.

Reporting

Registered users should report suspected security issues to their workspace administrator for escalation and key revocation. Do not include active credentials in a report.