# Harmony 3.0 security notes

Harmony keeps OpenAI, Twilio, and webhook credentials on the WordPress server. They are never included in the public chat configuration.

Public REST requests require a signed Harmony session token, are rate-limited, and use a hidden honeypot field. Chat messages are stripped of HTML and length-limited. Lead output is escaped in WordPress admin screens and customer-facing markup. CSV exports guard against spreadsheet formula injection. Custom webhooks use WordPress safe HTTP requests and can include an HMAC signature.

Keep WordPress, PHP, themes, and plugins updated. Limit WordPress administrator access, use HTTPS, protect backups, and rotate integration credentials after any suspected exposure.

Security issues should be reported privately to the site administrator rather than posted publicly.
