Security principles for Helio.

June 18, 2026

Helio is designed as infrastructure for backend teams, so security is treated as part of the product foundation. We prioritize secure authentication, hashed secrets, scoped access, input validation, conservative defaults, and operational controls that reduce the blast radius of mistakes.

• Dashboard APIs use user authentication and workspace/project authorization.
• Ingestion APIs use project API keys, separate from dashboard user sessions.
• API keys are generated with strong randomness, shown once, stored as hashes, searchable by prefix, and revocable.
• Revoked keys should stop accepting new ingestion traffic, and suspicious keys should be rotated immediately.

Passwords and API keys are not stored in plaintext. The SDK redacts common sensitive fields such as passwords, tokens, authorization headers, cookies, secrets, private keys, sessions, and JWTs before sending logs. Customers should still review what they log and avoid sending unnecessary sensitive data.

• Production configuration should be validated at startup so missing secrets fail fast.
• Databases, queues, and internal services should not be directly exposed to the public internet.
• Operational access should be limited to authorized maintainers and used only for legitimate support, security, and reliability work.
• Errors returned to users should avoid raw stack traces, database errors, and secret values.

If we identify a security incident affecting Helio users, we will investigate, contain the issue, rotate impacted secrets where appropriate, and notify affected customers through reasonable channels based on the nature and severity of the incident.

Report suspected vulnerabilities to hey@zynnode.com. Include a clear description, affected endpoint or feature, reproduction steps, impact, and any relevant screenshots or request IDs. Do not access data that is not yours, disrupt service, or publicly disclose the issue before we have had a reasonable opportunity to respond.

Keep account credentials secure, rotate API keys when staff or systems change, avoid logging secrets, apply SDK updates, configure reasonable retention, and limit project access to users who need it.