Security & support

What we protect, against whom and with which limits is described in the threat model.

Store tokens securely

Tokens belong in a password manager or the secret store of your system — never in websites, browser apps, emails, chat messages or Git. The API is intended for server-to-server calls only; browsers on other websites deliberately cannot call it.

If a token has fallen into the wrong hands

Revoke it immediately under Administration → API access — revocation takes effect from the next request. In an emergency, use “Revoke all”. Then create a new token. Under “Last used” you can see the time and IP address of the most recent use.

Report a vulnerability

Please report security concerns and vulnerabilities by email to security@manage2hero.com. The address is also in our security.txt (/.well-known/security.txt). We review your report and get back to you with any questions.

A report should contain:

• the affected endpoint or function
• the steps to reproduce the problem
• the suspected impact
• the request_id of the response concerned, if there is one

Please do not:

• send a token or secret — not even to demonstrate the problem
• send or collect customer data
• access other organizations’ data to prove the vulnerability
• run load tests or denial-of-service attempts against production

If you have lost a token, first revoke it immediately in the management app (see Security & support).

Support

When you have questions, always quote the request_id of the response concerned (it is in the body and in the X-Request-Id header). Never pass on the token itself — not even to us.

Operational status

Whether the API and webhook delivery are working right now is shown on the status page — with availability over the last 30 and 90 days and the most recent incidents. It needs no sign-in.