Bright Data Security and Use Review

Overview

Treat legal purpose, public-data scope, account roles, zone isolation, and application controls as one authorization chain. Provider access does not replace the customer's duty to restrict targets, fields, retention, and downstream use.

Prerequisites

• An integration inventory and named business and data owner
• The Bright Data acceptable-use and account-role documentation
• Secret-manager, egress, retention, and incident-response controls

Instructions

Step 1: Approve purpose and targets

Read the use case and Grep manifests for authenticated pages, personal or sensitive fields, messaging, purchases, account creation, or other prohibited activity. Refuse nonpublic information behind login.

Step 2: Minimize identity

Choose named-user API keys or product-specific zone credentials, apply the least account role, isolate environments, and document revocation. Never encode secret values in configuration examples.

Step 3: Enforce in the application

Write target and field allowlists, maximum records and bytes, retention, rate and cost ceilings, redirect rules, and fail-closed policy handling. Provider denial cannot trigger automatic evasion.

Step 4: Test and review

Edit tests to cover disallowed hosts, login redirects, secret redaction, oversized results, policy errors, and revoked access. Record owner approval and the next review condition.

Tool Discipline

Use Read and Grep to inspect policy, roles, configuration, and tests. Use Write and Edit only for approved manifests, controls, tests, and the security receipt. This skill grants no live collection or account-administration authority.

Output

• Purpose, target, and data authorization matrix
• Least-privilege identity and revocation plan
• Application guardrails, negative tests, and review receipt

Examples

Authorize a public product-price dataset with named fields and short retention. Deny login redirects and free-form URLs, bind one production zone to one worker role, and make every policy 403 a hard stop.

Error Handling

Resources

• Acceptable use policy
• Users management
• Authentication and API keys
• Proxy error catalog