Comments

• Thanks for the clear explanation — that makes sense. You're right that a client allowed to write but not permanently delete could do just as much damage by overwriting notes or metadata, and that a malicious local process wouldn't need a key at all.…

  in Feature Request: permission scopes for local API keys (e.g. write without permanent delete) Comment by Refworkbench yesterday at 10:20pm