How TechDash protects license keys, tokens, passwords, and webhooks

Learn which sensitive values TechDash protects locally and how to handle them safely.

Last checked 1 September 2026

TechDash gives selected sensitive values additional protection before storing them in its local database. This reduces accidental exposure if someone obtains only the database. It does not make the whole TechDash data folder safe to share, and it does not replace normal computer security.

Values that receive additional protection

The current app protects:

  • Your TechDash license key
  • Google Search Console access and refresh tokens
  • HTTP Basic Authentication passwords saved for websites
  • Shopify Web Bot Auth Signature-Input and Signature values saved for websites
  • Slack, Microsoft Teams, and Discord webhook URLs

Related information is not necessarily secret. Your license email, a Basic Authentication username, website addresses, Google property details, and crawl history can remain in ordinary local records. Treat the complete TechDash data directory and its backups as private.

TechDash uses a locally generated key to protect these values. The protected values and the key needed to use them are stored separately within TechDash's local application data. Someone or another program with access to the complete local data while signed in as the same operating-system user may still be able to recover saved values.

When TechDash uses a saved value

TechDash uses each secret only for the feature you configured:

  • The license key is sent to TechDash when activating, validating, unlinking, or checking update eligibility.
  • Google tokens are sent to Google's sign-in and Search Console services.
  • A Basic Authentication password is sent with eligible requests to the website where you saved it.
  • Shopify crawler signature values are sent only with in-scope crawl requests to that website's host.
  • A webhook URL is used to send a test, incident, or recovery notification to the selected Slack, Microsoft Teams, or Discord destination.

The license screen does not display the saved license key. Saved Shopify crawler signature values are not shown again after you save them. Website and notification settings may show other saved values that you need to review or replace. Anyone who can use your unlocked operating-system account and open TechDash may therefore be able to view or use some configured credentials.

Webhook URLs must use HTTPS destinations recognized for the selected provider. This limits accidental delivery to an unrelated host, but the selected workspace or channel still receives the notification content.

Protect the computer and backups

  1. Use a strong operating-system password and automatic screen locking.
  2. Enable full-disk encryption, such as FileVault or BitLocker, where appropriate.
  3. Limit access to the operating-system account, TechDash application data, and computer backups.
  4. Do not email or upload the TechDash database or secret-storage file.
  5. Keep license keys, passwords, Google tokens, and webhook URLs out of screenshots and copied incident text.
  6. If a credential may have been exposed, revoke or replace it at its provider, then update or reconnect it in TechDash.

Do not delete or replace only TechDash's secret-storage file. Saved protected values may stop working. Do not edit protected database fields manually.

Remove credentials for a website

Deleting a website removes that website's saved credentials and Google Search Console connection from the local TechDash database:

  1. Open Websites.
  2. Open the correct website card's context menu.
  3. Select Delete Website.
  4. In the Delete website confirmation, verify the display name and hostname in the message stating that the website, screenshot, and icon will be removed.
  5. Select Delete website.

Deletion succeeded when TechDash shows that the hostname was deleted and the website card disappears. Select Cancel if either identity is wrong. There is no in-app undo.

Deleting a website does not revoke the Google account grant or remove notifications already delivered to third-party services. If access must be withdrawn there too, revoke it through Google, Slack, Microsoft Teams, or Discord as applicable.

Unlinking the TechDash license clears the local license record, but it does not delete websites or their saved credentials. Use website deletion when the goal is to remove a website and its local data.

Optional technical note

Protected values are sealed so TechDash can detect altered data as well as conceal the original value. That detail does not change the customer guidance: protect the complete local data directory and never separate, publish, or selectively edit its files.

Related articles