Security advice

Keys and AI apps can do real things on your panel. A few habits keep that safe.

Keys

One key per use. One for the billing sync, one for your laptop, one for each AI tool. When one leaks or is retired, you revoke it alone.
The smallest scopes. Most integrations need read, or read + write. Give manage (deleting, credits, servers, settings) only where it is the point.
An end date on anything temporary: a test, a contractor's script, a trial integration.
Only from these addresses for a key used from a fixed server: a key copied elsewhere then does nothing.
Never in code you commit. Read keys from environment variables or your server's secret store. Never paste one in a chat, a ticket or a screenshot — including a chat with an AI app.
Revoke on any doubt. Revoking is instant and costs you one new key. Then read the call log to see what the key did.

Don't use the owner's account for integrations. Make a staff account for each integration with a group that has only the permissions it needs. See Accounts and permissions.
Turn on two-step sign-in for every account that makes keys or connects AI apps. A key can't change how its account signs in, but whoever signs in as the account can make new keys.
Disable accounts you no longer use. Their keys and apps stop at once.

Approve only what the app needs. read answers questions; write lets it act. Think twice before approving manage.
Read before you confirm. An AI app can misread what you asked. Before it runs something that changes your panel, read what it is about to do — the line, the package, the amount.
Don't let instructions from content drive the app. A web page, a document or a message you give an AI app can contain instructions written to trick it. Keep apps that hold write or manage on your panel away from content you don't trust, and confirm each change yourself.
Disconnect apps you stopped using under AI apps in the dashboard's menu.

Always HTTPS. Every example on these pages uses https://. A key sent over plain http:// can be read on the way.
Keep the panel updated. Updates bring security fixes; the dashboard says when one is ready.
Watch the call log now and then for keys you don't recognise, or calls at hours nothing of yours runs.

Found a security problem in Minimus itself? Write to [email protected] and don't share it publicly until it is fixed.