On this page
Secure Your MiniUp App
Secure a MiniUp app by choosing Site and dataset access intentionally, keeping private credentials in Function Secrets, and authorizing every protected backend operation.
Configure an app’s security boundaries
- Choose Site Access for the intended audience.
- Invite only the needed members and assign the least powerful useful role.
- Review each Table and file’s dataset access, including public links and cross-site grants.
- Put private service credentials in Function Secrets.
- Enforce roles and record ownership in the Site Members Function.
- Test with a lower-privilege account and while signed out before sharing.
Example: private applications with a public landing page
A Public Site can show general information while a Site Members Function requires membership for private operations. Do not put private records in the public HTML or download them before authorization. If even the frontend files should be restricted, use Invite-only or Private Site Access.
Protect browser-visible information
Anything returned to browser code can be inspected by the visitor. Bootstrap responses should contain only safe identity and configuration. Hiding an Admin button, JavaScript module, Gallery listing, or link does not protect an API or dataset.
Allowed Web Origins controls which websites can make browser requests; it does not authenticate non-browser callers. An API Key Function should be called from trusted code when a private key is required.
Respond to a shared credential
Replace or revoke the affected key using its product controls, update trusted callers, and publish again when Function Secrets changed. Remove exposed values from public files and examples. Changing a key does not remove copies of data already disclosed.