• Keep MOCEAN_API_TOKEN in trusted server-side secret configuration.
• Never place the token in browser or mobile code.
• Do not commit, print, or return the token to clients.
• Do not paste credentials into prompts.
• Review generated code and dependencies before running them.
• Use mocked HTTP responses for tests unless a live request is explicitly intended.
• Check both HTTP results and documented Mocean application-level status values.
• Apply normal application controls for webhooks, such as HTTPS, request-size limits, rate limits, idempotency, and safe logging.

Product coverage and updates