I have a private (static auth) project app that adds app cards to Contact and custom object records. Contacts on our HS Site (private portal) submit data via a customized form which then write to the custom object record. But we also need files uploaded to sensitive data props.
When I added the sensitive scopes to the app that has a card the build failed on the card:
“Using sensitive scope groups crm.objects.custom.sensitive.read,crm.objects.contacts.sensitive.write,crm.objects.custom.sensitive.write,crm.objects.contacts.sensitive.read with app cards is not allowed because of security restrictions. Please remove either the sensitive scope groups or the cards from your app and try again.”
So I split it into two apps, and one of them exists only to hold the scopes. The app cards overview now says apps with Sensitive Data scopes can include cards, but not hubspot.fetch() or serverless functions. Has the build rule changed on 2026.03? My functions only call HubSpot’s own CRM API and never read a sensitive property. Is there a supported way to keep cards, functions and sensitive scopes in one app?
Marketing Enterprise, CMS pro