Security: Clips are Completely Public. Need Private Clips
closed
Nick Day
All Clips have a link that anyone can access, even without a ClickUp account. Site scraping bots can find all publicly accessible links. This is a huge security concern.
While the addresses are long and perhaps unlikely for someone to find by scraping, security by obscurity is not security at all. The Clip address begins with my Workspace ID, so adversaries can even target my company's workspace specifically.
Clips created at my company could very easily include confidential information. As an admin, I have no way of knowing what Clips have been created, by whom, and who has access to them. Access to clips needs to be based on account authorization.
I'll note that forms have the same issue.
Log In
Louise Ewing
We are currently working on an option to have all attachments and Clips URLs behind Workspace authorization. This means that once we ship this functionality URL’s will only be accessible by users logged into your ClickUp Workspace.
This enhancement to how we manage attachments will be available on all ClickUp plans and will apply to both newly created and existing attachments.
We recommend following the Canny post linked below where our Product team is regularly posting updates.
Louise Ewing
closed
Louise Ewing
We are currently working on an option to have all attachments and Clips URLs behind Workspace authorization. This means that once we ship this functionality URL’s will only be accessible by users logged into your ClickUp Workspace.
This enhancement to how we manage attachments will be available on all ClickUp plans and will apply to both newly created and existing attachments.
We recommend following the Canny post linked below where our Product team is regularly posting updates.
Natalie Williams
Yikes! I didn't even realize that anyone can access clips. That is such a security breach that shouldn't even exist. If a clip is created in a private space then at the very list it should only be viewable by members of that space automatically.
Brent
Hey there! We greatly appreciate your feedback here. Please continue to share additional thoughts or details as we explore updates and enhancements to our Clips feature.
V
Vincent D'Amico
Brent I think the "my clips hub" needs an area so for each link created that you have access to. There should be a column in the recording You should have the ability to change the share settings with Videos URL's shared for ones user created.
I also feel that Clips / Ownership should be something that can be shared as Owners sorta like how Google Docs allows you to share documents and sheets.
It should also be a feature that Enterprise level has the capability to turn on and off for different users we may not want all users or groups to have access to create clips or to edit certain settings.
I might not want some users being able to manage these things or having the capability for clipping.
Brent
Vincent D'Amico: Hi Vincent, thanks so much for sharing this detailed feedback. Totally agree with your suggestions! The Clips Hub would be a great place to present sharing and other settings for individual Clips.
We're working on polishing the current experience then from there will look toward further updates and enhancements. We'd love to keep hearing feedback along the way!
Natalie Williams
Brent it doesn't seem right that security is an "enhancement" any information on when to expect private and secure clips?
Attila Horvath
until this is not fixed, loom stays in my stack.
Tamaryn
Attila Horvath: Exactly!
Tamaryn
I cannot second this enough. Everything that you just said. While it's in beta, the idea that this just rolled out like this for everyone on the Org without security optimization is insane. One of the reasons we picked ClickUp was because it seemed to value the security of sensitive data.