Security: guides & tutorials

Credential theft from scraped sites if you handle login flows, proxy credential exposure if stored improperly, malicious JavaScript execution if running untrusted pages in browsers, SSRF risks if actors accept arbitrary URLs from untrusted users, and data breach risks from storing scraped personal data without proper access controls.

Store credentials in Apify's environment variable secrets, never in actor source code or version control. Use scoped API tokens with minimum required permissions. Rotate tokens on a schedule and immediately after any potential exposure. Log all credential usage with timestamps. Use short-lived tokens for actor runs where possible.

SSRF when actors fetch user-supplied URLs without validation, injection risks in database writes from scraped content, broken access control if dataset permissions are too broad, security misconfiguration in proxy credentials and API keys, and insufficient logging when scrapers access personal data. Treat scraping infrastructure with the same rigor as web applications.

Implement rate limiting, use Cloudflare or Akamai bot management, add honeypot fields that legitimate users never trigger, use CAPTCHA on sensitive endpoints, monitor for suspicious traffic patterns, and review server logs for bot signatures. None of these measures are perfect—determined scrapers adapt—so focus on your actual risk exposure.