---
canonical: "https://agi-labo.com/en/tools/wings/docs/security"
title: "Security"
description: "Protect credentials, entry points, and logs."
section: "Data and safety"
order: 24
pageType: "concept"
lastVerifiedVersion: "1.4.16"
lastVerifiedAt: "2026-10-15"
draft: false
surfaces: ["cli", "console", "api"]
plans: ["free", "member"]
---

Connection credentials and Handler Secrets are encrypted when stored.
A Handler can use only the Connections named when it is deployed.
You do not need to embed credentials in source code.

Every external fetch is limited to a matching bound Connection, even for public hosts.
Use `--auth none` for public pages and feeds: no credential is stored or injected.
It allows one exact host, with no wildcard or suffix matching.
HTTPS/443, private-address and internal-host blocking, and same-origin redirects apply to this mode too.
Credentials from other Connections are never substituted.
See [Connections](/en/tools/wings/docs/connections).

## Choose how people can access the Handler

API Triggers use bearer authentication by default.
For a public Trigger, verify the sender's signature in your code.
Also check for duplicate events before processing them.

Web Apps are available only to their owners and people they are shared with.
Those people use the owner's permissions through the Handler.
Check authorization when changing data as well as when displaying it.

## Protect data

Keep Secrets and viewer email addresses out of results and logs.
Anything you output there is saved in the Run details.
Credential encryption does not hide that output.

On a shared computer, use `wings logout` to sign out of the CLI.
Check that the server also revoked the session.
For the Console and Web Apps, see [Web App sign-out](/en/tools/wings/docs/web-apps).

## Report a vulnerability

Do not include private values or real user data in public issues.
Use the contact in [security.txt](https://agi-labo.com/.well-known/security.txt), or email [lab@tempi.co.jp](mailto:lab@tempi.co.jp).
Identify the report as an AGI Wings security issue.

For general questions, use [Support](/en/tools/wings/docs/support).