pipeshub-ai

Least-privilege permissions

• Give connectors only what they need. When you connect PipesHub to services like Slack or Google Drive, grant the narrowest permissions possible—for example, "read files in the Marketing folder only" rather than full account access. Overly broad access means a breach affects more of your company.
• Rotate credential tokens regularly. Treat connector credentials (the digital keys that let PipesHub access your services) like passwords—refresh them every 30–90 days to limit damage if one is stolen.
• Separate credentials by team. If different agents serve different departments, use separate login credentials for each so a leaked credential only compromises one team's data, not everyone's.
• Audit who can deploy agents. Limit which employees can set up new agents or modify connector settings, since a rogue actor could create an agent with excessive permissions.

Network isolation

• Run PipesHub in a private network. Deploy it behind a firewall or within your company's internal network, not directly on the internet. Only allow trusted services to communicate with it.
• Use VPNs or encrypted tunnels to connectors. When PipesHub reaches out to external services (Slack, GitHub, etc.), encrypt the connection so credentials and data in transit cannot be intercepted.
• Restrict outbound access. Configure your firewall to block PipesHub from contacting unexpected external IP addresses or services, limiting where data can be exfiltrated.

Monitoring

• Log all data access and agent queries. Record which agents searched or cited which documents, so you can trace what data was used and by whom if a security incident occurs.
• Alert on unusual activity. Set up automated alerts for suspicious patterns—for example, if an agent suddenly accesses 10x more files than usual, or requests data outside its normal scope.
• Review connector logs weekly. Check whether any connector made unexpected calls or returned errors that might signal tampering or intrusion.
• Track dependency updates. Since PipesHub relies on 40+ third-party integrations, monitor security advisories for those tools and apply patches promptly.

Red flags to watch for

• Agents requesting credentials directly. If an agent or user asks to see connector passwords or tokens, or if logs show agents attempting to read credential files, treat it as a compromise attempt.
• Unexplained data appearing in outputs or chats. If citations or agent responses include sensitive documents that were never requested, investigate whether permissions were misapplied or an agent was manipulated to exfiltrate data.
• Failed authentication attempts spiking. Multiple login failures or unusual IP addresses trying to access PipesHub suggest an attacker is probing for entry points.
• Connectors going offline or returning errors. Unexpected failures in your integrations (Slack, Drive, etc.) can signal that credentials were revoked or that a security incident damaged the connection—investigate immediately.