--- name: fathom-security-basics-8f961d2d0904 description: 'Secure Fathom API keys and handle meeting data privacy. Trigger with phrases like "fathom security", "fathom api key safety", "fathom privacy". ' allowed-tools: Read, Write, Edit, Grep version: 1.6.0 license: MIT author: Jeremy Longshore tags: - saas - meeting-intelligence - ai-notes - fathom compatibility: Designed for Claude Code --- # Fathom Security Basics ## Prerequisites - A current recording/data classification, consent policy, scoped identity/secrets, and incident owner. ## Instructions 1. Apply least-privilege roles and approved recording/transcript access settings. 2. Keep credentials in the secret manager and meeting content out of logs and test fixtures. 3. Validate integrations and sharing controls with synthetic records before broad rollout. 4. Revoke access and follow the incident process on suspected exposure. ## Output - A controlled Fathom deployment with data/consent safeguards, scoped credentials, access review, and incident path. ## Examples Verify a development role can access only its synthetic meeting record and cannot retrieve production content, then record the redacted result and review date. If a token, recording, transcript, or participant data is exposed, contain/revoke first and follow the data incident process. ## Overview Fathom records and transcribes meetings, producing transcripts and action items that contain participant PII (names, emails, spoken content), confidential business decisions, and potentially sensitive negotiations. API keys are per-user and grant access to all meetings the user recorded or that were shared to their team. Protect recording consent workflows, transcript storage, and any analytics pipeline touching meeting content. ## API Key Management ```typescript function createFathomClient(): { apiKey: string; baseUrl: string } { const apiKey = process.env.FATHOM_API_KEY; if (!apiKey) { throw new Error("Missing FATHOM_API_KEY — store in secrets manager, never in code"); } // Fathom keys are per-user — never share across team members console.log("Fathom client initialized (key hash:", apiKey.slice(-4), ")"); return { apiKey, baseUrl: "https://api.fathom.video/v1" }; } ``` ## Webhook Signature Verification ```typescript import crypto from "crypto"; import { Request, Response, NextFunction } from "express"; function verifyFathomWebhook(req: Request, res: Response, next: NextFunction): void { const signature = req.headers["x-fathom-signature"] as string; const secret = process.env.FATHOM_WEBHOOK_SECRET!; const expected = crypto.createHmac("sha256", secret).update(req.body).digest("hex"); if (!signature || !crypto.timingSafeEqual(Buffer.from(signature), Buffer.from(expected))) { res.status(401).send("Invalid signature"); return; } next(); } ``` ## Input Validation ```typescript import { z } from "zod"; const MeetingQuerySchema = z.object({ meeting_id: z.string().uuid(), include_transcript: z.boolean().default(false), date_from: z.string().regex(/^\d{4}-\d{2}-\d{2}$/).optional(), date_to: z.string().regex(/^\d{4}-\d{2}-\d{2}$/).optional(), participant_email: z.string().email().optional(), }); function validateMeetingQuery(data: unknown) { return MeetingQuerySchema.parse(data); } ``` ## Data Protection ```typescript const FATHOM_PII_FIELDS = ["participant_email", "participant_name", "phone_number", "transcript_text"]; function redactFathomLog(record: Record): Record { const redacted = { ...record }; for (const field of FATHOM_PII_FIELDS) { if (field in redacted) redacted[field] = "[REDACTED]"; } // Also scrub emails from transcript snippets if (typeof redacted.summary === "string") { redacted.summary = (redacted.summary as string).replace(/[\w.+-]+@[\w-]+\.[\w.-]+/g, "[REDACTED_EMAIL]"); } return redacted; } ``` ## Security Checklist - [ ] API key stored in secrets manager, never in code - [ ] Meeting recordings and transcripts encrypted at rest - [ ] PII redacted in non-production environments - [ ] Webhook endpoints use HTTPS with signature verification - [ ] Access logs track per-user API key usage - [ ] Recording consent verified before processing transcripts - [ ] Transcript data retention policy enforced - [ ] Action items containing confidential terms scrubbed before export ## Error Handling | Vulnerability | Risk | Mitigation | |---|---|---| | Leaked API key | Access to all user meetings and transcripts | Secrets manager + key regeneration | | Unredacted transcripts in logs | Participant PII exposure | Field-level redaction pipeline | | Missing recording consent | Legal liability under two-party consent laws | Consent verification before processing | | Unencrypted transcript storage | Bulk meeting data breach | Encryption at rest + access controls | | Overly broad meeting sharing | Confidential content exposed to wrong teams | Per-meeting permission scoping | ## Resources - [Fathom API Documentation](https://fathom.video) - [OWASP API Security Top 10](https://owasp.org/www-project-api-security/) ## Next Steps See `fathom-prod-checklist`. --- Source attribution: jeremylongshore Original project: https://github.com/jeremylongshore/claude-code-plugins-plus-skills/blob/ab85a061f7bcc039dac13ee193de7a4cd4388571/plugins/saas-packs/fathom-pack/skills/fathom-security-basics/SKILL.md License: MIT License information: https://opensource.org/license/mit Original upstream instructions; downloaded from Mega AI Hub. ## Upstream license notice MIT License Copyright (c) 2025 Jeremy Longshore Permission is hereby granted, free of charge, to any person obtaining a copy of this software and associated documentation files (the "Software"), to deal in the Software without restriction, including without limitation the rights to use, copy, modify, merge, publish, distribute, sublicense, and/or sell copies of the Software, and to permit persons to whom the Software is furnished to do so, subject to the following conditions: The above copyright notice and this permission notice shall be included in all copies or substantial portions of the Software. THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE. # Mega AI Hub resource metadata Creator / publisher: jeremylongshore Original project: https://github.com/jeremylongshore/claude-code-plugins-plus-skills/blob/ab85a061f7bcc039dac13ee193de7a4cd4388571/plugins/saas-packs/fathom-pack/skills/fathom-security-basics/SKILL.md Attribution basis: Source repository record Fields of work: Data & Analytics, Development & Engineering Roles: Data Analyst, ML / AI Engineer, Security Engineer Specialties: API, Design, Word Documents, Frontend, Remotion Tools: Fathom Country applicability: Country not specified Classification basis: Source catalog labels Instruction SHA-256: 7233520d49514ba604e88c3b2e3c86b27f5f8f4a2b15e27a3158ffb1ebfe12ef