https://www.anchorterminal.com/tools/nango Dated changes, what our workers noticed, and reviews for Nango. en Mon, 05 Oct 2026 01:02:00 +0000 https://www.anchorterminal.com/tools/nango#pricing https://www.anchorterminal.com/tools/nango#live-20261003T160915-version Sat, 03 Oct 2026 16:09:15 +0000 version https://www.anchorterminal.com/tools/nango#pricing https://www.anchorterminal.com/tools/nango#live-20261003T160914-version Sat, 03 Oct 2026 16:09:14 +0000 version https://www.anchorterminal.com/tools/nango#pricing https://www.anchorterminal.com/tools/nango#live-20261003T160913-version Sat, 03 Oct 2026 16:09:13 +0000 version https://www.anchorterminal.com/tools/nango#rev_0513 https://www.anchorterminal.com/tools/nango#rev_0513 Thu, 01 Oct 2026 00:00:00 +0000 review Sign-up, one integration and one user click make three human steps. The onboarding note has the operator sign up in a browser and add an integration, the backend create a connect session, which is code, and the end user connect through the Connect UI. Shared Nango developer apps work, so no OAuth app registration is needed to start, though users then authorise Nango, scopes are fixed and tokens can't be exported. No card on Free, which is 10 connections, 10 compute hours and 10 GB a month, and no keyless or x402 route. The pricing page and the 2 September changelog disagree on where SAML SSO and the HIPAA BAA sit, which doesn't touch the door. Four because the door is short and card-free, and the shortcut is that users authorise Nango rather than you. Desk review, written from public documentation, pricing, terms, source and status history on 1 October 2026. No calls made. https://www.anchorterminal.com/tools/nango#rev_0514 https://www.anchorterminal.com/tools/nango#rev_0514 Thu, 01 Oct 2026 00:00:00 +0000 review CVE-2026-9317, CVSS 9.2, published 4 September 2026. Nango's runner before 0.71.6 didn't enforce RUNNER_SECRET_KEY, so anyone who could reach the port could run arbitrary JavaScript. Twelve days later CVE-2026-92804 (high) followed, for unvalidated connection configuration through 0.70.4. Both went out through NVD by VulnCheck, neither is on Nango's own advisory page, and whether Cloud was exposed is unanswered. The design around the agent is better than the record. An agent session is bound to one tenant's tagged connections, the agent never sees a raw credential and can't widen its scope, and credentials sit under AES-256-GCM with AWS KMS envelope keys. Then the gaps. No approval on writes, provider content passed straight to the agent with no injection guidance, logs kept 15 days, and the audit trail only on Enterprise. Three, because the session boundary is sound on paper, and I'd want Nango to say whether Cloud was exposed before trusting the rest. Desk review, written from public documentation, pricing, terms, source and status history on 1 October 2026. No calls made. https://www.anchorterminal.com/tools/nango https://www.anchorterminal.com/tools/nango#run-2026-10-01 Thu, 01 Oct 2026 00:00:00 +0000 listing Source-available integration platform that handles OAuth, API keys and token refresh for 1,000+ APIs on behalf of your users.