Security
Account security
Protect access and report a concern without sharing secrets.
If you suspect unwanted access, disconnect the unfamiliar app or revoke the exposed token from your account settings. If your Google sign-in is affected, use Google's recovery process too. The checks below help you find the right control.
Review access
Check the account identity before saving private work or authorizing a service. Different account controls cover different kinds of access:
| What you want to review | Where to go |
|---|---|
| Apps and AI agents you approved | Connected apps |
| CLI, desktop and personal-token access | Access tokens |
| Computers using a plugin license | Plug-in activations |
| Sign-in identity and optional GitHub connections | General settings |
| App registrations you manage for your own products | Creator apps |
When approving a new connection, grant only the access needed for the task. Store developer tokens securely and keep them out of shared source, chat messages, screenshots and logs. Sign-in help and connected apps explain the main paths.
On the tokens page, check the name, permissions and last recorded use. Where available, Recent agent activity shows operations made through Maru's API or agent connector, including whether an operation completed, failed or lacked permission. Use Usage and credits to investigate generation spending.
Protect sign-in and pairing codes
Maru sign-in uses your Google account. Keep that account secure and use Google's recovery process if you lose control of it. GitHub can be linked as a developer identity; it is separate from the Google sign-in method.
The Connect Studio fallback creates a single-use, expiring sign-in code. Treat a live code like a password and enter it only in the Studio installation you are connecting. Anyone with the unused code could use it to sign in as you.
GitHub repository access is another separate connection. In General settings, Sign-in and connected accounts links your developer identity, while Publish from GitHub manages the repository integration. Review repository choices in the GitHub App's installation settings; removing a linked identity is not the same as revoking that installation.
If you suspect unwanted access
Disconnect an unrecognized app or agent from Connected apps. Revoke a lost or exposed token from Access tokens, then configure a replacement only in the tool you intend to keep using. Also remove an unwanted connector from the assistant's own settings so it does not keep asking to reconnect.
If you sold a computer or need to remove a plugin license from it, use Remove in Plug-in activations. This frees its activation; the plugin stops at its next license check. Revoking the token used to sign in for activation does not itself remove the computer's license activation.
For unwanted GitHub repository access, disconnect the repository integration and review or revoke its installation permissions on GitHub. If the Google account used for sign-in is affected, use Google's recovery process too.
Contact Maru with a concise description and the approximate time. Do not include active secrets, private recordings or a full project unless support agrees a suitable way to receive them.
Report a security issue
Use the contact page to ask for the appropriate private reporting channel. Share enough to identify the concern without publishing credentials or other people's information.
See privacy and compliance for policy and data-handling questions.
Protect a product you create
Use creator-app registration and supported consent flows for connected features. Never distribute a personal token or server secret inside an instrument, browser page or downloadable project. The public app identity and a secret credential serve different purposes.
When using installed helpers, follow their supported local connection instructions. For customer access, use the product's licensing and entitlement flow instead of treating a hidden link as protection.