Overview
Pabble handles form creation, published forms, responses, analytics, and integrations. Security documentation should focus on the practices and boundaries that can be verified in the product and codebase.
Application security layers
Show authentication, team boundaries, form access settings, response storage, integration credentials, and webhook delivery.
Recommended visual: 1440 x 900
Security Areas To Review
Authentication and access
Dashboard access, team membership, project organization, form ownership, and response visibility should be reviewed together because they define who can manage and inspect form data.
Form access settings
Product copy can reference visible form access concepts such as public forms, password protection, submission settings, and related security settings where those controls exist.
Response data
Responses may include personal or business-sensitive data. Pabble should make response access, export, deletion, and integration handoff clear to users.
Integrations and webhooks
Available integrations include Google Sheets and custom HTTPS webhooks. Webhook copy can describe HTTPS endpoints and structured payloads, and should avoid claiming delivery guarantees unless those guarantees are documented.
Secret handling
Integration credentials and signing secrets should be treated as sensitive application secrets. Public docs should avoid revealing implementation details that are not meant to be operational guidance.
Responsible Disclosure
Until a formal disclosure program is published, security reports should go through the contact page with enough detail for the team to reproduce the issue.