- Verify
initData(and its age) on your server before trusting anything in it. - Keep
client_secret, access tokens and refresh tokens on your server. If the secret leaks, rotate it. - The
idis the user's DiiL id, stable across apps. Don't use it as a secret. - DiiL doesn't share contacts, chats or messages with mini apps.
- The Developer Agreement covers what you may do with user data.