Skip to content

Security

Runtime safeguards

The library includes secure defaults for query and expression execution:

  • Series.query supports function predicates only.
  • Dynamic string predicate execution is not supported.
  • SQL request object validation is mandatory.
  • Placeholder interpolation is blocked unless explicitly enabled.
  • Apps Script execution API access is set to MYSELF.

SQL placeholder guidance

Prefer provider-native parameterization where possible.

If you use placeholder substitution:

  • Treat substituted values as untrusted input.
  • Restrict allowed values with explicit allowlists.
  • Set options.allowUnsafePlaceholders=true only for controlled/internal queries.

Credential handling

Do not commit credentials:

  • .clasp.json
  • .clasprc.json
  • OAuth client secrets or refresh tokens

Use repository or organization secrets for CI-based integration runs.

For storage workflows, use script properties/runtime config instead of inline secrets:

  • GCS_SERVICE_ACCOUNT_JSON
  • S3_ACCESS_KEY_ID, S3_SECRET_ACCESS_KEY, S3_SESSION_TOKEN
  • DATABRICKS_TOKEN

OAuth scopes

The library currently declares scopes for:

  • External requests
  • Cloud Platform (required for vertex_gemini)
  • Spreadsheets
  • Drive
  • BigQuery
  • Docs / Slides / Forms

Only authorize consumer scripts for the surfaces you actually use.

Release checklist (security focus)

  • Confirm no secret files are tracked.
  • Confirm no dynamic SQL interpolation paths were introduced unintentionally.
  • Confirm appsscript.json execution API access remains non-public.
  • Re-run integration tests after any auth/scope changes.