Attio Integration Security Baseline

Overview

This skill audits and hardens Attio authentication, data handling, webhook verification, tenant boundaries, and operational response without exposing secrets or customer records.

Prerequisites

• Data-flow and trust-boundary inventory
• Endpoint-to-scope map and tenant model
• Secret-store, logging, retention, and incident-response owners
• Webhook receiver code when events are enabled

Tool Discipline

Use Read, Glob, and Grep to inspect credential flow, authorization, logs, storage, and webhook handling. Use WebFetch only for current official Attio security contracts. Use Write or Edit after findings, target controls, and rollback conditions are approved.

Current Contract