Attachments and Clips URLs behind Workspace authorization
Sydney
Hey Canny Community!
We wanted to start a new thread here on the topic of attachments and Clips URLs from ClickUp. Currently, attachments and Clips can be protected using the private attachment feature that expires the links after an hour. We have already kicked off work on further enhancing how we handle attachments and Clips in the product and have a dedicated team working on this. To enable easy sharing of attachments via links, the current method of using an unguessable, randomized sequence of characters in the URL was designed and implemented at a time when this was the industry standard. Search engines do not have access or index these links unless you intentionally add the link to a public, indexed page. The links are not known to anyone externally.
While many similar products to ClickUp still use this same methodology, we understand that our users want and need additional security for their attachments and Clips.
To address this, we wanted to give you a transparent update on the plans and timeline to expect changes. We will have an option to have attachments and Clips URLs behind Workspace authorization and, as of now, we plan to have this completed by the end of July. This would mean that the URL would only be accessible when a user is logged in to your Workspace.
We are also going to give you the ability to turn off attachment uploads entirely for your Workspace if that is your preference.
We appreciate your patience while we work diligently to give you control of how you would like your attachments and Clips URLs handled.
Log In
Luci N.
Hey, everyone!
We wanted to provide a quick update on the Secure Attachments Early Access Beta! The Beta going great, and we're up to 10s of Workspaces in use. Things seem to be working for everyone!
We've noticed that the Workspaces in the Beta aren't making much use of public sharing of items like Lists, tasks and Docs. We're still waiting to see more of these sharing use cases being used to confirm that all attachments are shared properly. Because of this, we are taking it slow and steady.
The good news is that the Beta is now open to everyone, and we will accept any Workspace to the Beta. If you're interested in participating and are an admin of an active ClickUp Workspace, please send an email to help@clickup.com with the subject line “Secure Attachments Early Access Beta”. We’d love to have you join!
Michael Schoch
Any updates on this?
Luci N.
Hey, everyone!
We wanted to provide a quick update on the Secure Attachments Early Access Beta! The Beta going great, and we're up to 10s of Workspaces in use. Things seem to be working for everyone!
We've noticed that the Workspaces in the Beta aren't making much use of public sharing of items like Lists, tasks and Docs. We're still waiting to see more of these sharing use cases being used to confirm that all attachments are shared properly. Because of this, we are taking it slow and steady.
The good news is that the Beta is now open to everyone, and we will accept any Workspace to the Beta. If you're interested in participating and are an admin of an active ClickUp Workspace, please send an email to help@clickup.com with the subject line “Secure Attachments Early Access Beta”. We’d love to have you join!
V
Vincent D'Amico
Luci N. if we had questions about some specifics would we still email help@clickup.com with the same questions?
Thank you!
Nick Day
Luci N. Thank you for the update.
Jamie G.
Hey, Vincent! Yes, please direct your questions to help@clickup.com so they can assist you further!
Louise Ewing
Hi Everyone!
Excited to share a quick update that we are making great progress on this feature!
At this time we are ready to accept submissions for inclusion in an early access beta program to try out this functionality before we move to general release.
If you are interested in participating in the beta program and are an admin of an active ClickUp Workspace please send an email to help@clickup.com with the subject line “Secure Attachments Early Access Beta”
Joana Pereira
any news on this?
Clips URLs are behaving strangely now: I record a clip, copy the URL to post it on a task, the automaticallyURL changes automaticaly from a https://sharing.clickup.com/clip/ps/etc link to a https://t24450310.ps.clickup-attachments.com/etc link that shows "Sorry, this file doesn't exist or you do not have access to it." ?
Natalie Williams
Joana Pereira I'm having this will all types of attachments now. Expiring links are fine for some things, but they're not good for the vast majority of attachments. If a file is attached to a task that I'm the owner of then I want to be able to access that at any time not just the first hour.
C
Claire Cockle
Hello is there any news on this feature yet? Thanks
Nick Day
Louise Ewing Sydney Any update on this? How have the 3 month of Early Access Beta testing gone? Is there a timeline for getting this released?
Nick Day
Sydney It's been almost 4 months since the beta was announced. I'm waiting for secure attachments before my team can put attachments to use, and it's really holding us back. Can we please get an update, including an estimate of when this will be released?
Brent
Hi Joana Pereira, please report this issue using our bug form so we can investigate. You'll also be notified after the issue has been fixed.
Thank you!
Cassandra Anderson
Sydney, great news. Are you considering creating an admin view of Clips or a view all public clips? Right now, I can only see my clips and not the entire orgs clips, even those shared with me, and I'm an admin
Louise Ewing
Cassandra Anderson: Thanks so much for that feedback! We will share it with our Clips team!
Nick Day
Wonderful news. Thank you for addressing this security issue, giving us updates on related canny.io threads to point to this thread, and for giving us a clear expectation of timeline. That's all very appreciated.
Nick Day
Brent , Sydney, Can we please get an update on this feature that has been in beta test for 4 months?
Brent
Hi Nick Day, Luci posted an update today that's now pinned to the top of this request!
Naomi Peters
can you please confirm if this security feature will only be available for certain plan levels?
Louise Ewing
Naomi Peters: This enhancement will apply to all ClickUp plans.
Tim Jasper
This is ridiculous. Why can't you just lock the attachments behind the clickup users account like most other plaforms manage to do?
Louise Ewing
Tim Jasper: That is exactly what the security enhancement as outlined above will do and it will launch for customers end of July!
Tim Jasper
Thanks
Grainne Arif
Could you confirm whether attachments & clips are publicly available once they are uploaded into the workspace OR are they only publicly available if you click on Share > Copy URL? I’m getting conflicting answers on this from ClickUp Support. The answer to this is critical for me to know how to proceed & keep our data safe
M
Magda Kasprzycka
Can you please confirm this?
Louise Ewing
Magda Kasprzycka Grainne Arif attachments are only publicly available if you specifically chose to share them external to the Workspace by generating a public link which is a feature that you have to manually turn on for each publicly shared object by toggling 'share link with anyone' on. Clicking share > copy URL just copies the internal link to the ClickUp object for ease of sharing with others in the Workspace.
Grainne Arif
Hi Louise, thanks for the reply but every time I get a response from ClickUp re this I get more confused.
I see that there's a 'Share' link in each task and you can then toggle 'share link with anyone' but if I DON'T have this turned on for a task (for instance) and I go to an attachment within that task and click 'Copy URL' next to the attachment, the attachment is then available publicly.
I've tested this by going to a different device where I'm not logged into ClickUp and I can see that attachment publicly which makes me presume that attachments are publicly available even when I haven't specifically chosen to share them.
Is there something I'm doing wrong/not understanding?
It's also still available after an hour despite have that option toggled on.
Louise Ewing
Grainne Arif: If private attachments is turned ON for the Workspace and the object the attachment is linked to is not explicitly made public (by toggling 'share link with anyone') then the link should expire after one hour. This of course will all be enhanced with our new feature putting all attachments behind authentication which will launch soon! I will reach out to you via email to help with your specific use case in the meantime!
Grainne Arif
thank you.
I have never selected 'share link with anyone' but the attachment is available to view online. I did check and the attachment was uploaded before I turned on 'private attachments' so I can understand why it's still there based on the one hour rule BUT as I haven't selected 'share link with anyone' EVER on this attachment, I didn't think anyone would be able to view it publicly. This is my main question all along which no-one at ClickUp seems to be grasping. I understand the one hour rule but I haven't chosen to publicly share it AT ALL and it IS publicly available.
So, going back to your comment above:
"attachments are only publicly available if you specifically chose to share them external to the Workspace by generating a public link which is a feature that you have to manually turn on for each publicly shared object by toggling 'share link with anyone' on. Clicking share > copy URL just copies the internal link to the ClickUp object for ease of sharing with others in the Workspace."
What you have said above seems to contradict with this, this is why I keep coming back to it, no-one seems to be clarifying exactly what happens and we keep going round in circles.
I'll reply to your email to continue this.
Thank you for your help, it's appreciated.
Louise Ewing
Hey Canny Community!
We wanted to start a new thread here on the topic of attachments and Clips URLs from ClickUp.
Currently, attachments and Clips can be protected using the private attachment feature that expires the links after an hour. We have already kicked off work on further enhancing how we handle attachments and Clips in the product and have a dedicated team working on this.
To enable easy sharing of attachments via links, the current method of using an unguessable, randomized sequence of characters in the URL was designed and implemented at a time when this was the industry standard.
Search engines do not have access or index these links unless you intentionally add the link to a public, indexed page. The links are not known to anyone externally.
Grainne Arif
but they could be found by a hacker despite the randomised link which is the main issue that we all have. Looking forward to an update in July
Naomi Peters
I am very happy that this enhancement is being worked on; however, in the meantime, I think it is not helpful to refer to the links expiring after an hour.
(1) Your own documentation specifies that a new link is generated every time a task is opened or the attachment exported. So the expiration only really matters if you don’t ever open that task again.
(2) I’ve already tested & found that a link still works after an hour if you use it in the same browser (not having cleared the cache).
Tamaryn
I'm really glad our team never really used or trusted attachments or clips. While it likes to bill itself as a software to replace all the other software—it's really not. It's not great file storage (especially if security is an issue). The forms could use an update (forms don't email you when you have a new response; when share links are turned off it's awkward)... and it was clear clips and link sharing was going to be a huge problem given everything was automatically public.
For those of us who have non-disclosure agreements with our clients and have access to protected intellectual property, we knew enough to not use the tools that looked suss 👀 from a privacy standpoint.
Louise Ewing
Naomi Peters: We are going to reach out to you directly to figure out what might be happening in your specific use case.
Louise Ewing
Tamaryn: Thanks for your feedback as mentioned above we are making a lot of enhancements in this area and we are constantly updating all areas of the product to meet the evolving needs of our customers. We always appreciate your comments and suggestions!
Tamaryn
ClickUp does continually add new features and enhancements. Truth be told, that's why we haven't given up on it. But the security of data needs to be at the top of the hierarchy.
Louise Ewing
Tamaryn: rest assured it absolutely is!
Jennifer Hall
This is important and will be watching for the release in July.
Load More
→