Access
The server keeps only a hash of each service key. API data is scoped to the organization. See Authentication.
Secrets
Secret values stay on the computer or host that runs the Method. They are never in the Method file and never sent to Method. They are replaced with[REDACTED] in every run file. A secret value found in a Method or its files is the error secret_value, and method publish refuses it. See Secrets.
Local processes
Scripts and local agents (Codex, Claude Code) run as trusted local processes with the access of your operating-system user. A local agent keeps its installed tools. A step’stools list controls which Method tools the agent gets; it does not limit the agent’s own tools. changes is a declaration, not a permission rule. Read a Method and its scripts before you run them.
Script cards and observed effects show what a script does, but they do not stop it.
Run records and webhooks
Run records can hold inputs, prompts, outputs, and local paths. Local records have private file permissions. Withrun_data: device, run content stays on the computer that ran it, and production questions and answers are encrypted with a key derived from the app’s key. See Privacy.
Webhooks are signed with Method-Signature: t=TIMESTAMP,v1=HMAC. Verify the raw body with Method.webhooks.verify before you trust it. See Production runs.