Data App security
The data apps beta is available only on Tableau Cloud.
Data apps execute custom code in the viewer's browser and query Tableau data at runtime. Review both the code and the access it requires before publishing. Tableau hosting and data permissions provide controls for the app, but app owners still need to review dependencies and how data is used.
Confirm that the required settings are enabled on your Tableau Cloud site. Available controls and supported capabilities depend on your site configuration. Use the settings provided by your site when approving or disabling an app.
Content access and data permissions
A data app runs as the viewing user and queries Tableau data at runtime. The queryAsync() and readMetadata() methods added for this release provide data and metadata access; they do not grant additional data-source permissions. Access to the workbook and access to its data are separate considerations: being able to open an app does not grant additional permissions to its data sources.
Use Tableau content permissions to determine who can publish, view, and manage the workbook. Review the permissions and row-level security on the data sources that power the app. Test with accounts representing the intended audiences, rather than relying on the publisher's experience alone.
Keep security rules in the data layer. Hiding a field or control in the app's interface does not prevent access to data that a query returns. Request only the data needed for the user's task, and avoid embedding a fixed copy of sensitive data in HTML or JavaScript.
Tableau-hosted resources
The app's HTML, JavaScript, CSS, images, and other front-end resources are embedded in a packaged workbook and served by Tableau. This removes the need to operate a separate web server for those resources and lets you distribute the app with its workbook.
Hosting does not replace code review. Review application code and third-party libraries before publishing, including code generated by an AI agent. The packaged resources run in the viewer's browser; do not place passwords, access tokens, or other secrets in them.
Tableau hosting covers the bundled front-end resources. If the app depends on an external service, that service still requires its own availability, access controls, and approval.
External origins
An external origin is a combination of protocol, host, and port, such as https://api.example.com. Apps declare the external origins needed to load resources or connect to services. Administrators control which origins are allowed.
Before approving an origin, understand what the app uses it for. Loading a charting library from a CDN and sending query results to a third-party API have different implications for your data.
| Dependency | Questions to review |
|---|---|
| Scripts and styles | Who maintains the library, and can the required version be bundled with the app? |
| Images, fonts, and other assets | Does the app need to load them externally, or can they be included in the package? |
| Third-party APIs | What information leaves Tableau, where is it sent, and does that use meet your organization's policies? |
Approve only the origins required for the app's intended behavior. Bundling resources where practical reduces external dependencies. An allowed origin does not replace any authentication or browser access requirements imposed by the external service.
Tableau REST API access
The fetch() method added to the Extensions API for this release enables data apps to make a curated set of Tableau REST API requests. Apps declare the Tableau REST API access they require for administrator review. Review these requests separately from external origins: an external dependency does not imply permission to call Tableau APIs.
For each requested API, identify the action the app performs and why it is needed. Give particular attention to operations that create, change, or delete content. Approve only the access required for the workflow.
Declared API access does not grant the viewer additional Tableau permissions. The app must use the supported Extensions API mechanism for Tableau REST requests and remain within the site's approved access.
Test security before sharing
Test the published app with representative viewer accounts, including users with restricted data access. Confirm that the results respect data-source permissions and row-level security, and that requests stay within the approved external origins and Tableau API access.
Verify that missing permissions and failed queries produce useful messages without exposing sensitive details. Repeat the review when the app changes its data sources, dependencies, or API usage.