Built with hardcoded security
Even if your connector URL is compromised, the damage is minimal by design.
The safety limits aren't instructions Claude is told to follow — they live in the server code and cannot be overridden by any prompt, leaked URL, or injected instruction.
Worst case if your URL leaks: someone can create paused campaigns — but they start PAUSED with a capped budget, so nothing spends automatically. You see all of it in the activity log and regenerate your URL to cut off access immediately.