Run the library only for accounts, teams, and members you are authorized to administer. The embedding application should require an explicit approval before calling invite, role-update, or removal flows.

• Supply a callback, not a global plaintext password.
• Fetch the password as late as possible from an OS keyring, secret manager, or equivalent protected store.
• Never log callback arguments, return values, page HTML, cookies, storage state, or raw provider responses.
• Use a separate persistent profile directory per Canva account and restrict filesystem permissions to the operating user.

The flow loads a password only if a saved session cannot be verified. Password fields are filled while holding the page preview lock and are cleared before screenshots resume.

Login actions require HTTPS and a canva.com host. Read and mutation flows verify the expected account. Team mutations additionally verify the exact external team key before and after the action.

Do not weaken these checks to accommodate redirects or ambiguous UI. Add a new explicit provider state and test it instead.

CAPTCHA, MFA, consent, re-authentication, checkpoints, and risk pages are manual gates. The correct response is to stop automation, let an authorized operator inspect the visible browser, and resume only after the provider gate is legitimately completed.

StepRecorder.record() uses Playwright screenshot styling to hide text and blur images. This reduces exposure but is not a formal data-loss-prevention boundary. Review captures before sharing them.

record_diagnostic() writes caller-provided text without additional redaction. Only pass bounded, already-redacted structural information. Never include join URLs, response bodies, emails, tokens, cookies, or passwords.

resolve_proxy() accepts HTTP, HTTPS, SOCKS4, and SOCKS5 URLs, validates host syntax, and passes credentials separately to Playwright. Do not log the returned mapping because it can contain proxy credentials.

When a proxy is configured, Camoufox geo-IP alignment is enabled. A manually configured timezone can still conflict with the proxy's observed location; the caller owns that decision.

Never launch the same persistent profile directory concurrently. Serialize all access per account at the embedding layer. The library only serializes screenshot access within a page; it is not a distributed lock.

Pin dependencies in deployed environments. Before updating Camoufox, Playwright, or selectors, run the complete fake-page suite and perform an authorized read-only account/team check. Test mutations separately with an explicit manual gate.