Sourcing uses authenticated access, role-aware permissions, protected admin routes, authenticated extension requests, and audit records to support secure operations. Security and operational records are retained as needed for service operation, security, legal, and audit purposes. Access to Sourcing administration and related service systems is limited to authorized personnel through the controls used for the service.
Authenticated access
Admin pages are protected by the admin authentication boundary. Extension APIs require authenticated requests before operational data can be read or changed.
Extension boundary
The shared backend accepts requests from valid internal Chrome extension origins while keeping access independent of a hardcoded extension ID in the environment.
Role-aware operations
Admin, QA, and Sourcing are separate operating roles. The workspace controls who can manage structure, review decisions, or execute targets.
Auditability
Authentication and operational events can be retained in the audit record so teams can investigate changes without relying on memory or chat history.
Security principles#
Sourcing follows a least-privilege direction: authenticate users, validate requests, keep the API boundary explicit, and make sensitive operations visible. Passwords should be stored as one-way hashes, tokens should be treated as secrets, and production deployments should use HTTPS.
Operational responsibilities#
Security is shared between the software, the deployment environment, and the people who administer it. Hostinger account access, database credentials, backups, extension distribution, password resets, and user removal should be managed by authorized administrators.
Incident response#
If you believe an account, token, database, or extension package has been compromised, revoke access, rotate relevant credentials, preserve the audit record, and contact the Sourcing administrator through the internal support process.
Questions about this document?
Reach the Sourcing team through the support page, or contact the administrator responsible for your account.