Best practices
A few habits keep your architecture maps safe to share and safe to keep.
Never put secrets in a map
Canopy maps describe architecture, not credentials. Treat them like a diagram you might screenshot into a doc.
- Reference a secret by name (
STRIPE_SECRET_KEY), never its value. - Don't paste API keys, tokens, connection strings, or passwords into node labels, descriptions, or purpose fields.
- The same applies to exports - a
CLAUDE.mdorAGENTS.mdlands in your repo, so keep it free of secrets too.
Exports inherit your repo's visibility
A CLAUDE.md committed to a public repo is public. Keep architecture exports
in private repos unless the map is meant to be public.
Grant the least access needed
Roles are assigned per workspace. Default to the smallest role that works:
- Viewer - read-only. Use this for stakeholders who just need to see the map.
- Editor - can edit maps but not invite or manage billing.
- Admin - full edit, and can invite Editors/Viewers into open (already-paid) seats. Can't change roles, remove members, or manage billing.
- Owner - full workspace control: member management, billing, Stripe payouts, paid-template listing, and verification requests.
Editors and Admins occupy a paid seat (Viewers are free), so invite people deliberately and remove members when they leave - removing a member frees their seat and revokes their access immediately. See Roles & permissions.
Share deliberately
- Keep maps workspace-only (private) unless they're genuinely meant to be public.
- Publish a map only when you intend it to be visible to anyone with the link; for internal review, keep it inside the workspace instead.
- Review your public profile before publishing - only maps you mark public appear there.
- Unpublish or rotate share links you no longer need.
Strengthen sign-in
-
Turn on two-factor authentication - it is the single biggest upgrade to your account's security.
-
Sign in with GitHub so your Canopy access inherits GitHub's protections, including its MFA.
-
Keep the email tied to your account secure - password reset links are sent there.
-
The API and MCP server act with your workspace's permissions - treat any access token like a password.
-
Store tokens in environment variables or a secrets manager, never in code or a map.
-
Rotate tokens periodically and revoke any you suspect are exposed.
Where to go next
- Two-factor authentication - set it up in a couple of minutes.
- Data & privacy - what is stored and who can read it.
- Report a vulnerability - if you find a hole, tell us.