Rotate API keys and integration credentials

Best practices when staff leave or vendors change.

Disconnect unused integrations from the dashboard when replacing vendors.

Rotate webhook secrets after any suspected endpoint exposure.

Limit team admin access — owners should retain billing and integration permissions.