fix(credentials): close the PR-wide audit findings

Docs describe credential-only Telegram and Typeform actions and the issuer's
query/fragment refusal, PagerDuty and Grain copy name every token type that
works, Granola accepts a key whose note scope an admin turned off, a GitLab
reply that isn't a token lookup reports the provider, and Semrush's catalog
entry matches staging exactly.

Author: waleedlatif1

apps/docs/content/docs/integrations/aws-credentials.mdx

@@ -58,7 +58,7 @@ To rotate a key, create the new key in AWS, reconnect the credential with it, co
 Keyless roles need two things on a self-hosted deployment:
 
 - `WORKLOAD_IDENTITY_SIGNING_KEY`: a PKCS#8 PEM RSA private key that signs Sim's tokens.
-- An issuer AWS can reach over the public internet: an `https` URL on the default port, served by a certificate from a public CA. It defaults to `<NEXT_PUBLIC_APP_URL>/oidc/workload`; set `WORKLOAD_IDENTITY_ISSUER` to pin it. Trust policies reference this URL, so never change it once roles trust it. Sim keeps keyless off when the issuer isn't `https` or names a port, because AWS can't use it.
+- An issuer AWS can reach over the public internet: an `https` URL on the default port, served by a certificate from a public CA. It defaults to `<NEXT_PUBLIC_APP_URL>/oidc/workload`; set `WORKLOAD_IDENTITY_ISSUER` to pin it. Trust policies reference this URL, so never change it once roles trust it. Sim keeps keyless off when the issuer isn't `https` or names a port, query, or fragment, because AWS can't use it.
 
 Generate a key with `openssl genpkey -algorithm RSA -pkeyopt rsa_keygen_bits:2048`.
 

apps/docs/content/docs/integrations/telegram.mdx

@@ -27,7 +27,7 @@ The [webhook setup video](https://www.youtube.com/embed/9oKcJtQ0_IM) also demons
 
 1. Add the bot to the group and grant the permissions needed by the action.
 2. Obtain the group's numeric chat ID from a bot message update, such as the trigger's `message.raw.chat.id`. Group IDs can be negative.
-3. Add a Telegram action block, select **Send Message**, and set **Bot Token**, **Chat ID**, and **Message**.
+3. Add a Telegram action block, select **Send Message**, choose a **Telegram Credential** (a saved bot token), and set **Chat ID** and **Message**.
 4. Run the workflow and verify the message in the group.
 
 The [group messaging video](https://www.youtube.com/embed/AG55LpUreGI) demonstrates the block configuration. Bot privacy settings affect which group messages Telegram delivers; receiving a command addressed to the bot can help verify the trigger before changing those settings.

apps/docs/content/docs/integrations/typeform.mdx

@@ -10,7 +10,7 @@ import { ReferenceDetails } from "@/components/ui/reference-details"
 
 
 {/* MANUAL-CONTENT-START:intro */}
-Use [Typeform](https://www.typeform.com/) in Sim to retrieve form responses, download submitted files, and get form insights. Switch to trigger mode to start a workflow when a form is submitted. The integration requires an API key.
+Use [Typeform](https://www.typeform.com/) in Sim to retrieve form responses, download submitted files, and get form insights. Switch to trigger mode to start a workflow when a form is submitted. Actions sign in with a saved Typeform credential (a personal access token with the `forms:read` scope); the trigger takes its own token.
 {/* MANUAL-CONTENT-END */}
 
 ## Use the block [#usage-instructions]

apps/docs/content/docs/platform/self-hosting/environment-variables.mdx

@@ -167,7 +167,7 @@ Saved AWS and Databricks credentials can trust Sim through OpenID Connect instea
 | Variable | Description |
 | --- | --- |
 | `WORKLOAD_IDENTITY_SIGNING_KEY` | PKCS#8 PEM RSA private key that signs Sim's workload-identity tokens: `openssl genpkey -algorithm RSA -pkeyopt rsa_keygen_bits:2048` |
-| `WORKLOAD_IDENTITY_ISSUER` | Issuer URL clouds trust. Defaults to `<NEXT_PUBLIC_APP_URL>/oidc/workload`; must be `https` on the default port and reachable from the public internet, or keyless stays off. Never change it once trust policies reference it. |
+| `WORKLOAD_IDENTITY_ISSUER` | Issuer URL clouds trust. Defaults to `<NEXT_PUBLIC_APP_URL>/oidc/workload`; must be `https` on the default port, with no query or fragment, and reachable from the public internet, or keyless stays off. Never change it once trust policies reference it. |
 | `WORKLOAD_IDENTITY_PREVIOUS_KEY` | A second published key (private or public PEM) that never signs: the incoming key before a rotation, or the retiring key after it |
 
 See [AWS credentials](/integrations/aws-credentials#self-hosted-deployments) for setup and the rotation steps.

apps/sim/lib/credentials/token-service-accounts/descriptors.ts

@@ -1587,7 +1587,7 @@ export const TOKEN_SERVICE_ACCOUNT_DESCRIPTORS: Record<
     ],
     docsUrl: 'https://docs.sim.ai/integrations/grain',
     helpText:
-      'Create a personal access token in Grain under Settings > Integrations > API. It has the same access you have in Grain.',
+      'Create a personal or workspace access token in Grain under Settings > Integrations > API. A personal token has the same access you have in Grain.',
   },
   [GRANOLA_SERVICE_ACCOUNT_PROVIDER_ID]: {
     providerId: GRANOLA_SERVICE_ACCOUNT_PROVIDER_ID,
@@ -1629,7 +1629,7 @@ export const TOKEN_SERVICE_ACCOUNT_DESCRIPTORS: Record<
     ],
     docsUrl: 'https://docs.sim.ai/integrations/pagerduty',
     helpText:
-      'An account administrator creates REST API keys in PagerDuty under Integrations > API Access Keys. Creating, updating, snoozing, merging, and noting incidents needs a full-access key; a read-only key covers the list and get operations.',
+      'Use an account REST API key (an administrator creates it under Integrations > API Access Keys) or a personal user API token (User Settings > API Access). Creating, updating, snoozing, merging, and noting incidents needs a full-access key; a read-only key covers the list and get operations.',
   },
   [RESEND_SERVICE_ACCOUNT_PROVIDER_ID]: {
     providerId: RESEND_SERVICE_ACCOUNT_PROVIDER_ID,

apps/sim/lib/credentials/token-service-accounts/validators/gitlab.test.ts

@@ -51,8 +51,11 @@ describe('GitLab saved token verification', () => {
     ).rejects.toMatchObject({ code: 'invalid_credentials' })
   })
 
-  it('reports a malformed token lookup as GitLab misbehaving, not as a bad token', async () => {
-    fetch.mockResolvedValue(new Response('<html>', { status: 200 }))
+  it.each([
+    ['an HTML page', new Response('<html>', { status: 200 })],
+    ['JSON that is not a token lookup', jsonResponse({ ok: true })],
+  ])('reports %s as GitLab misbehaving, not as a bad token', async (_, reply) => {
+    fetch.mockResolvedValue(reply)
 
     await expect(
       validateGitLabServiceAccount({ apiToken: 'glpat-x', domain: 'gitlab.com' })

apps/sim/lib/credentials/token-service-accounts/validators/gitlab.ts

@@ -72,6 +72,12 @@ export async function validateGitLabServiceAccount(
     })
   }
   const token = toRecord(body)
+  if (typeof token.active !== 'boolean' || !Array.isArray(token.scopes)) {
+    throw new TokenServiceAccountValidationError('provider_unavailable', 502, {
+      step: 'verify',
+      reason: 'GitLab returned an unexpected token lookup',
+    })
+  }
   const scopes = toArray(token.scopes)
   if (
     token.active !== true ||

apps/sim/lib/credentials/token-service-accounts/validators/token-checks.ts

@@ -407,9 +407,13 @@ export const validateGrainServiceAccount = tokenCheckValidator({
   }),
 })
 
-/** Listing one Granola note answers 200 for a valid personal or workspace API key and 401 otherwise. */
+/**
+ * Listing one Granola note answers 200 for a valid personal or workspace API key and 401 otherwise.
+ * An Enterprise admin can turn off note scopes for members, so a JSON 403 still proves the key.
+ */
 export const validateGranolaServiceAccount = tokenCheckValidator({
   serviceLabel: 'Granola',
+  forbiddenMeansScoped: true,
   request: ({ apiToken }) => ({
     url: `${GRANOLA_API_BASE}/notes?page_size=1`,
     headers: { ...granolaHeaders(apiToken), Accept: 'application/json' },

apps/sim/lib/credentials/workload-identity/issuer.test.ts

@@ -106,6 +106,7 @@ describe('workload identity issuer', () => {
     'http://sim.example.com/oidc/workload',
     'https://sim.example.com:3000/oidc/workload',
     'https://sim.example.com/oidc/workload?tenant=1',
+    'https://sim.example.com/oidc/workload#keys',
   ])('stays off for an issuer no cloud can fetch (%s)', async (url) => {
     setEnv('WORKLOAD_IDENTITY_ISSUER', url)
     const issuer = await loadIssuer()

packages/deployment-config/src/integrations.json

@@ -25244,7 +25244,7 @@
       "category": "tools",
       "integrationType": "analytics",
       "tags": ["seo", "marketing", "data-analytics"],
-      "updatedAt": "2026-11-10"
+      "updatedAt": "2026-10-14"
     },
     {
       "type": "sendblue",