grammarly-security-basics

# Grammarly Security Basics ## Overview Grammarly processes user-written text content for grammar, tone, and style suggestions. Integrations handle document text that may contain confidential business communications, legal drafts, or personal correspondence. Security concerns include OAuth client credential management, ensuring user text is not persisted or logged unnecessarily, and protecting access tokens that grant read/write access to user documents and suggestion history. ## API Key Management ```typescript function createGrammarlyClient(): { clientId: string; clientSecret: string } { const clientId = process.env.GRAMMARLY_CLIENT_ID; const clientSecret = process.env.GRAMMARLY_CLIENT_SECRET; if (!clientId || !clientSecret) { throw new Error("Missing GRAMMARLY_CLIENT_ID or GRAMMARLY_CLIENT_SECRET"); } // Access tokens from client_credentials grant — never persist to disk console.log("Grammarly client initialized (client ID:", clientId.slice(0, 8), "...)"); return { clientId, clientSecret }; } ``` ## Webhook Signature Verification ```typescript import crypto from "crypto"; import { Request, Response, NextFunction } from "express"; function verifyGrammarlyWebhook(req: Request, res: Response, next: NextFunction): void { const signature = req.headers["x-grammarly-signature"] as string; const secret = process.env.GRAMMARLY_WEBHOOK_SECRET!; const expected = crypto.createHmac("sha256", secret).update(req.body).digest("hex"); if (!signature || !crypto...