mirror of
https://github.com/plankanban/planka.git
synced 2026-02-25 03:14:50 +03:00
Security Concern: Slack Integration Sending Data Regardless of Board Permissions #481
Reference in New Issue
Block a user
Delete Branch "%!s()"
Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?
Originally created by @mattboll on GitHub (Apr 19, 2024).
I've identified a potential security concern with our Slack integration. Currently, all data is being sent to Slack channels when the configuration is on, regardless of the user's permissions on the boards. This poses a significant risk as sensitive information might be exposed to unauthorized individuals. Any insights or suggestions on how to mitigate this risk would be greatly appreciated.
I guess we should specify at some point which board should be sent to slack
@mattboll commented on GitHub (Apr 19, 2024):
Even more, instead of a global configuration of the slack bot in environment variable, it should be something by board with the bot token and channel id specific to a board (and I really mean a board and not a project/workspace)
@meltyshev commented on GitHub (Apr 21, 2024):
Hi! I was thinking about this too when I was accepting this PR. I think we at least need to add a comment to Slack env variables so that users pay attention to it. But of course it would be nice to be able to configure this for specific boards :)
@meltyshev commented on GitHub (May 14, 2025):
Should be resolved in v2 with the new notification settings.