Keep production credentials on trusted servers, request only the scopes you need,
verify TLS and keep sensitive member information out of unapproved debugging systems.
Credential storage
Use encrypted secret storage and rotate credentials after suspected exposure.
Least privilege
Separate applications when systems require materially different permissions.
Log hygiene
Log request IDs and state transitions, not full bearer credentials or KYC files.
Transport security
Use HTTPS and verify the server certificate. Do not disable peer verification.
