Merge remote-tracking branch 'origin/main' into claude/issue-20166-manifest-beside-config

Claude-Session: https://claude.ai/code/session_local_1d2a197c-c20e-4e90-9be8-413d4d432289
Co-authored-by: Claude <noreply@anthropic.com>

Author: hotlong

content/docs/automation/connectors.mdx

@@ -114,6 +114,8 @@ Materializes a single **`request`** action accepting
 payload per call. Use it when the upstream is "just HTTP" and you don't have a
 spec document.
 
+Do not put a credential in `headers` or `defaultHeaders`: both are stored in metadata and served with it. Declare it as `auth.credentialRef` instead — the resolved `auth` is applied to every request — as the `Authorization` header, or for `api-key` as `headerName` (default `X-API-Key`) or the `paramName` query parameter.
+
 ### `provider: 'openapi'` — one action per operation
 
 Config: **`spec`** (required) and **`baseUrl`** (optional — overrides the

content/docs/automation/flows.mdx

@@ -261,15 +261,19 @@ nothing is assigned or written in its place.
 {
   id: 'notify_slack',
   type: 'http',
-  label: 'Send Slack Notification',
+  label: 'Post Order Event',
   config: {
-    url: 'https://hooks.slack.com/services/...',
+    url: 'https://api.example.com/v1/order-events',
     method: 'POST',
-    body: { text: 'New order: {record.name}' },
+    body: { event: 'order.created', name: '{record.name}' },
   },
 }
 ```
 
+<Callout type="warn" title="Do not put a secret in an http node's url or headers">
+A flow definition, including an `http` node's `url` and `headers`, is served to every member who can read flows. A token, API key or signed webhook url written there is readable by all of them. Route an outbound credential to a declarative connector's `auth.credentialRef` and call it with a `connector_action` node instead — see [Connectors](/docs/automation/connectors#authentication). Only `signingSecret` (and a start node's `secret`) is withheld when a definition is served; `url` and `headers` are served as written.
+</Callout>
+
 **Script:**
 
 The built-in `script` executor never evaluates an arbitrary JavaScript string —