Before you authorize an Apps Script, check what it can touch.

What are you agreeing to when a copied Apps Script asks to access your spreadsheets or send email as you? A small script can request consequential permissions. Its length, its price and whether an AI wrote it tell you very little about the access it needs.

Treat the review as a data-flow check. Name the inputs, the destinations and the actions that change something. A spreadsheet-to-email script has a simple expected path: read selected cells, calculate values, render text, send to configured recipients. Anything else deserves an explanation before you authorize it.

Apps Script detects authorization requirements by scanning code. Google notes that even commented-out code can affect requested permissions. Selecting a harmless-looking preview function is therefore not a promise of a narrow consent screen. Review every file and any included libraries, not just the entry point you plan to run.

The Project Overview shows Project OAuth Scopes. Where a manifest explicitly lists scopes, inspect appsscript.json too. Google warns that automatic detection can choose more permissive scopes than a script needs. Compare each requested capability with the actual service calls, and stop when an unexpected permission cannot be explained. Do not blindly add broader scopes just to make an error disappear.

The method matters. SpreadsheetApp.openById uses the spreadsheets authorization scope. A configuration containing one spreadsheet ID tells your code which file to open; it does not turn that account-level capability into a technical restriction to that ID. A promise that "the code only reads this Sheet" and a permission that enables broader spreadsheet access are different statements.

Google provides an OnlyCurrentDoc annotation for suitable document-bound designs. It is not a magic sticker for arbitrary code that opens other files by ID. If you change the access model, test the changed workflow rather than assuming the old script still works. For an initial review, an isolated test account with no personal documents is a simpler way to reduce the consequences of a mistake.

MailApp is for sending mail and cannot read a user's Gmail inbox. GmailApp offers broader mail operations. If the task is only to send a summary, ask why inbox-reading code or permissions are present. Conversely, an invoice-ingestion workflow genuinely has a different access requirement from a metrics email.

Sending is still an external effect. Once spreadsheet values enter an email, they leave the Sheet and reach the configured recipients and their mail systems. Inspect recipient configuration, CC/BCC settings, attachments and any UrlFetchApp calls. "No separate server" must not be used as a synonym for "no data leaves the account".

DRY_RUN is just a convention implemented by the author. Read where the check occurs: it may skip the final send while still reading files or writing logs. Use fictional values and a controlled recipient even for the preview. Never paste customer data into a test log to make the example feel realistic.

For our Weekly Digest, the current code reads configured ranges before checking whether to send. Its preview and offline tests are useful, but they do not prove Google delivery. A careful test records consent, a known-data preview, one manual received email and a separate scheduled execution. These are acceptance checks, not instructions to grant access before reviewing the code.

Installable triggers execute as the account that created them. Closing the browser does not remove that schedule. Keep the test project identifiable, inspect its triggers and delete the test schedule when finished. Review the execution record rather than treating the absence of an open window as proof nothing is running.

Then remove the fictional test artifacts and revoke the script's access through your Google account connections if the test is over. Retain a sanitized result, not tokens, private document links or mailbox screenshots. A trustworthy install guide should describe this exit as clearly as it describes the setup.