Ask for fewer OAuth scopes so your client actually clicks Allow
You paste a script for a client. They hit Run. Google shows “See, edit, create, and delete all of your Google Sheets spreadsheets.” They…
Ask for fewer OAuth scopes so your client actually clicks Allow
You paste a script for a client. They hit Run. Google shows “See, edit, create, and delete all of your Google Sheets spreadsheets.” They…
Script Property Keys For Prompt
Ask Co-Pilot for a script that calls your CRM and it will invent CRM_KEY when you already have HUBSPOT_TOKEN in Script Properties…
Require Shared Secret
A public /exec URL is easy to leak, so your doPost shouldn't trust whoever calls it. requireSharedSecret(e, propertyKey) reads the expected…
Escape Leading Formula
You imported a CSV of support notes. One row started with =HYPERLINK(...) (or just =1+1, or a phone number typed as +15551212). Sheets…
Mask Secret
Debugging “is the API key loaded?” should not paste Script Property values into a shared Log sheet. maskSecret(secret, keepStart, keepEnd…
Escape HTML for HtmlService
Stuffing sheet values straight into HtmlService HTML is how < in a client name breaks the sidebar — or worse, opens an XSS footgun…