Developer Guidelines
The safety and security principles every developer building on CardStack is expected to follow.
Core principles
Secrets stay out of code
Never hardcode API keys, tokens, or credentials into a card, backend function, or repo. Use environment variables and rotate any key you suspect was exposed immediately from the Developer Keys page.
Scope data to the signed-in user
Row Level Security is enabled on every table by default. Every query you write should filter by the authenticated user — never rely on the client to enforce ownership.
Treat all input as untrusted
Validate and sanitize request bodies, query params, and file uploads before they touch storage, the database, or another API. Reject malformed or oversized payloads early.
Design around rate limits
Deployed cards and API keys are rate-limited to keep the platform fair for everyone. Build in retries with backoff instead of hammering an endpoint on failure.
Publish responsibly
Anything you publish from Studio becomes visible to other developers. No malicious code, scrapers, credential harvesting, or content that violates the Terms of Service.
Report issues, don’t exploit them
If you find a security gap in the platform itself, report it through Security Alerts rather than testing it against other developers’ cards or data.