# General Input is CASA Tier 2 verified

> General Input passed CASA Tier 2, the App Defense Alliance security assessment Google requires for restricted Gmail and Drive scopes.

May 24, 2026. Topics: Security, Platform. https://www.generalinput.com/changelog/2026-05-24-casa-verified

General Input is now CASA Tier 2 verified. CASA (Cloud Application Security Assessment) is the App Defense Alliance's review, and Google requires it before an app can use restricted scopes such as reading and modifying Gmail or full Google Drive access. To prepare, we ran the platform through the same dynamic and static scans the assessment uses and fixed what they found across the API, the dashboard, and our edge.

### What changed

- **Error responses.** Server errors return a generic message; details are logged, never echoed back.
- **Logs.** Tokens, cookies, and secrets are redacted before a log line leaves the process.
- **Caching.** Every API response is marked no-store, since responses are private to a session.
- **Rendered output.** HTML produced by agents renders in a sandboxed frame with no access to the dashboard.
- **Transport and headers.** TLS 1.2 or later, plus a Content Security Policy, HSTS with preload, clickjacking protection, a strict referrer policy, and a Permissions-Policy that restricts 21 browser features.
- **Dependencies.** Packages with published advisories are pinned to patched versions.

### Also shipped

- Password reset by email.