-
-
Notifications
You must be signed in to change notification settings - Fork 650
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
Security Concern: Slack Integration Sending Data Regardless of Board Permissions #722
Comments
Even more, instead of a global configuration of the slack bot in environment variable, it should be something by board with the bot token and channel id specific to a board (and I really mean a board and not a project/workspace) |
Hi! I was thinking about this too when I was accepting this PR. I think we at least need to add a comment to Slack env variables so that users pay attention to it. But of course it would be nice to be able to configure this for specific boards :) |
I've identified a potential security concern with our Slack integration. Currently, all data is being sent to Slack channels when the configuration is on, regardless of the user's permissions on the boards. This poses a significant risk as sensitive information might be exposed to unauthorized individuals. Any insights or suggestions on how to mitigate this risk would be greatly appreciated.
I guess we should specify at some point which board should be sent to slack
The text was updated successfully, but these errors were encountered: