Capture and email
Capture integrations are disabled until an administrator creates an explicit boundary. Start with manual browser uploads, then enable one connector and test its failure handling before adding another.
Watched folders
Allow only dedicated directories. Do not point Jiandu at a home directory or a broad shared mount. Decide whether another tool writes files atomically, how duplicates are handled, and where failed inputs remain visible for recovery.
Network scanners
Direct eSCL/AirScan jobs require an explicit network allowlist. Give scanners stable addresses and restrict reachability to the intended devices. Treat a scanner as an input source, not as a trusted administrator.
Linux/SANE capture agent
The agent uses one-use enrollment. Enroll it from Settings, keep its state directory private and persistent, and verify that an agent restart resumes safely. If its state is lost, revoke the old enrollment and create a new one instead of copying opaque state between machines.
Email connectors
The current browser application does not expose email-connector administration. Create, authorize, enable, inspect, and delete connectors through the generated connector API only if that is an acceptable operating workflow.
The current connector uses the Gmail API and admits supported PDF attachments. It requests Gmail's read-only OAuth scope: Jiandu does not move, label, mark read, or delete a source message after either success or failure.
Create a separate mailbox or narrow the mail that reaches it. Store the credential-sealing key and OAuth client secret in owner-only files, back up the sealing key separately, and keep the original message until you have verified the resulting document. Duplicate attachments are checked by content and stable attachment identity; unsupported attachments are skipped without blocking other PDFs in the same poll.
Mailbox authorization requires the same real public HTTPS origin used by the configured ingress boundary. A loopback-only installation cannot complete the provider consent flow. If a stored grant is rejected, the connector discards it, enters needs_reauthorization, and stops polling until an administrator authorizes it again.
For reliability practices, see reliable intake. Search the error guide with the exact message when a connector stops.