For developers

Security and publishing safeguards

How access is stored, which rights to give, and the checks before every publication.

Access

• The access you give SiteHome (an application password, a token or an API key) is stored encrypted on SiteHome's server. It never reaches the app or the browser, and is only used to read and publish the content groups you chose.
• Give SiteHome its own access, with no more rights than needed: in WordPress a user with the Editor role, in Sanity a token with editor rights, in Payload a dedicated user with a restricted MCP key enabling the approved content/media capabilities and the two SiteHome custom tools.
• You can revoke it at any time in your CMS (delete the application password, token or key); SiteHome then stops working with that website.

Safeguards when publishing

• Nothing is published without the exact review and an explicit tap.
• Publishing is off for a newly connected website until an administrator switches it on.
• Right before writing, SiteHome reads the item again. WordPress also checks the revision on the website. Official Payload MCP checks schema/source/foreign drafts again and confirms values/status afterward, but does not offer an atomic revision guard: a simultaneous change between the final read and write can still be overwritten.
• On WordPress, SiteHome also stops when someone else has unsaved work in the block editor for that item.
• On Sanity, SiteHome publishes through a draft with draft and published revision checks, and never overwrites someone else's draft or deletes a document.
• Taking an item off the website keeps it as a draft in the CMS.

Connecting

A website (a Sanity dataset or a website address) can be connected once. Someone else who wants to use it is invited by its administrator; SiteHome never takes over an existing connection.