Can you restrict who can send an email to update the status?

[First Title]

We're in the process if implementing this solution and when security reviewed the process their comment was that security through obscurity isn't appropriate.

The email address used to update the status is very long, random and unique enough not to be guessed. However, if this email address gets compromised then anyone from any random source address can update the status.

Is there a way to restrict the update to a predefined list of source domains and/or email addresses?

[Darryl Lee · Accepted solution]

Hi @First Title

This is Darryl. I am here to help. 

Thanks for the feedback on the security concerns about the Email automation for Statuspage components.

Unfortunately, there is no way to restrict the "from" sources for the Emil automation and we do have an existing feature request to "Create Allowlist for Email Addresses used in Component Automation".

The ticket ID is, STATUS-348, and we will keep you posted because the ticket doesn't provide any public access to our customers.

Thank you very much again for your feedback in helping us improve Statuspage.

Have a great day and stay safe.

Kind regards,
Darryl Lee
Support Engineer, Atlassian

[Darryl Lee]

@First Title, On the other hand, we also recommend switching to using the third-party services (Pingdom/New Relic) or the "unsupported" third-party services as alternatives for Statuspage component status automation. -> https://support.atlassian.com/statuspage/docs/get-started-with-email-automation/#Using-third-party-services

Or, if you also have an Opsgenie subscription, it would be awesome to incorporate the Statuspage integration for accomplishing this objective.

Hope this helps.

Kind regards,
Darryl Lee
Support Engineer, Atlassian

[First Title]

Thanks for your reply, happy to be on your distribution list to be notified when STATUS-348 get released into production. 

The third-party & alternate services to update the component still rely on an obscure email address which doesn't mitigate the security concern raised initially.

I note there is no option to turn off the email address or this automation service. Even if we chose to only update the components manually, the risk remains the same.

[Darryl Lee]

Thanks for the extra feedback and I have added them to the feature request ticket for our development team as a reference.