Lack of link anonimization when opening cards is a severe security risk

[Christian Radwanski]

Question:
When opening a card in Trello, it shows the link with the card title, can you anonymize this data?.

Summary:
We consider this a severe security breach and the links are being monitored/browser data and in some cases to external parties. We have determined that this goes against our security policies and must block Trello if there is no way of resolving this issue.

Example:

Employee opens card named: increase wage for Anna to 5000$,.
Links shows: trello.com/c/xxxx/increase-wage-for-Anna-to-5000$
Or worse: connect-private-servername-to-private-connector

Allot of personal data and corporate data is being displayed to unauthorized users this way, e.g. network monitoring team. It is substantially worse for our customers who have outsourced this part to external parties. As of now, we are in a position where we must recommend blocking Trello.com entirely.

You can set your Trello board to private, but your link openly leeches information out to other teams and external parties.

[Rishabh S]

Hi Christian 🙂

Hope you’re doing well, and welcome to the community!

You can safely share Trello card links using just the card ID. For example, if you have a full card URL like: https://trello.com/c/xxxx/increase-wage-for-Anna-to-5000$

The actual shareable card link is just: https://trello.com/c/xxxx

A few key points to keep in mind:

• You can share just the short card link (https://trello.com/c/xxxx) with any external user or team.

• This short link is generated when you click on the three dots (…) on the card back and choose the “Share” option.

• The full link with the card title (e.g. /increase-wage-for-Anna-to-5000$) will only fully resolve and show the card details for users who already have access to the board/card.

• If a user does not have access, opening the short card link will not expose the card title or its contents — access permissions still apply.

Thanks

[Christian Radwanski]

Hi Rishash, the problem is not sharing, the problem is just opening the card on your board. At that moment the link while you are working on your card, is now in your browser and shared on the network. Private data is effectively and immediately stored locally and sent to the network/monitoring team where it is stored again.

At that moment during audits, the private data is visible to others outside your board.