Use least privilege
Give the connector read scopes only. If a user only needs drawing summaries, do not grant broad admin access. If project access can be limited, limit it.
Protect API keys
- Store keys in the approved connector config or secret manager.
- Never paste keys into Claude, Slack, email, screenshots, or support tickets.
- Rotate keys when a team member leaves or a key may have been exposed.
- Disable keys that are no longer used.
Understand the boundary
A read-only connector can still reveal sensitive project information to the user operating Claude. Only enable it for people who are allowed to see the underlying Redliner project data.