Security overview

Multi-Level Board Dependencies is a JavaScript/Node.js backend hosted on monday Code. The application is designed to keep the amount of customer data it stores small and to rely on monday's platform services for hosting, secure storage, and runtime authentication.

Hosting and storage

Authentication

Sensitive integration, action, webhook, and lifecycle requests are authenticated using monday-issued/signed tokens appropriate to each flow. The App also uses OAuth for asynchronous hierarchy-trigger processing when a short-lived action token is no longer available.

Input and network controls

Identifiers, column keys, Status values, and URLs are validated and bounded before use. Dynamic outbound URLs must use HTTPS and are checked against local/private-network destinations. Outbound HTTP requests are time-bounded.

AI security

The optional AI action separates the user's instructions from board data and tells the model to treat item names, column values, Updates/comments, and activity-log entries as data rather than executable instructions. Prompt/context sizes are bounded, and generated Numbers output must pass numeric validation before being written.

Logging

Normal application diagnostics intentionally avoid raw OAuth credentials, item names, raw board-column contents, AI instructions, and prompt contents. Developer-controlled exported/copied diagnostic logs are retained no longer than 3 days.

Data deletion

When an authenticated uninstall lifecycle event is received, the App deletes its indexed app-controlled account records and stored OAuth credentials and attempts to remove related monday board webhooks.

Report a security issue

Please report suspected vulnerabilities privately to support@multilevelboarddependencies.com. Do not include sensitive monday board data unless requested through a secure support channel.