An embed is not an administrator credential

A public widget identifier is used to load a customer-facing experience. It is not permission to manage accounts, billing, or private conversations. Use only the dashboard-generated public installation code in your store.

Keep secrets off the client

Never paste database credentials, private API keys, payment secrets, session cookies, or internal service tokens into a theme, tag manager, browser console snippet, or support screenshot. Do not reuse example code from an unverified source.

If something was exposed

Remove the exposed material from the public location and notify the responsible administrator or provider so credentials can be revoked or rotated. Removing a screenshot does not invalidate the secret it contained. Use a private support channel and redact unrelated customer information.