Security

How Whippy protects your data

No shared secrets. You sign in with OAuth. You never paste an API key or password into an assistant, and the assistant never sees your Whippy password.
PKCE on every sign-in. Clients are public OAuth clients and must use PKCE (S256), so a stolen authorization code can't be exchanged for a token.
Approved callbacks only. Whippy only sends sign-in codes to callback URLs on its allow-list (Claude, ChatGPT, Cursor, Devin, Grok, VS Code, Windsurf, and http://localhost:8787/callback). A look-alike app can't register its own website as a callback.
Your permissions, nothing more. Every tool call is checked against your current Whippy role and the token's scopes, with the same rules as the public API.
One workspace per connection. A token only works in the workspace chosen at sign-in.
Instant revocation. Disconnect an app from Connected apps and its tokens stop working immediately. Disabling a user disconnects all of their apps.
Audit trail. Tool calls are logged with the user, the workspace, and the OAuth app that made them.

Keep approvals on for write tools. Assistants can send messages, change contacts, and delete records. Leave your client's "ask before running" setting on for tools that aren't read-only. The tool reference marks every tool as read-only, write, or destructive.
Watch for prompt injection. Text in messages, contact notes, form responses, and web pages can contain instructions aimed at the AI. Before you approve a tool call, check that it matches what you asked for, especially after the assistant has read customer-written content.
Connect only clients you trust. Treat an MCP connection like signing in to Whippy on another device.
Use the least-privileged account that does the job. For shared or automated setups, connect with a user whose role covers only what the assistant needs.
Review Connected apps regularly and disconnect anything you no longer use.