#Security Best Practices

Follow these practices to keep your TheVibeCRM integrations and webhook endpoints secure.

1. Keep webhook secrets private — never expose them in client-side code, public repos, or logs.
2. Use HTTPS — all webhook endpoints should be accessed over HTTPS to prevent secret interception.
3. Rotate secrets if compromised — delete the listener and create a new one to generate a fresh secret.
4. Restrict Supabase keys — if using the Supabase integration, prefer the anon key with appropriate RLS policies over the service_role key.
5. Monitor webhook activity — check the "Last Synced" timestamp on your listeners to ensure they're receiving data.
6. Stripe keys — use Stripe restricted keys with only the permissions you need when possible.
7. Google Calendar — TheVibeCRM only requests read-only scopes; revoke access anytime from your Google Account permissions.

#Field Mapping Reference

When configuring a Supabase listener, you map your source columns to these lead fields: