Elsa Workflows / Security and data

Security and privacy

The server profile is kept in plugin settings and the credentials in plugin secrets. The browser receives true or false for each credential, never the value.
OAuth access tokens are kept in memory only, and refresh tokens are never stored. A 401 clears the cached token and retries once.
Every call resolves the host, refuses private and metadata addresses, and pins the connection to the checked address while TLS keeps the real hostname. Redirects are followed only for reads, on the same origin, at most three times. Response sizes are capped.
Credentials are only sent to the Elsa paths the connector uses. Definition and instance ids are limited to 80 letters, digits, _, and -.
Errors from Elsa become one of a fixed set of categories, such as auth, timeout, or tls, so a response body, URL, or secret never reaches the admin or the logs.
The audit log keeps the last 100 connection changes and workflow starts: who, which definition, and the outcome, never the input.

Careful

JUSTFLOWS_ELSA_ALLOW_PRIVATE=1 on the Justflows process allows HTTP, other ports, and private addresses, for a local Elsa. It applies to the whole process, not one site, so never set it in production.