Kristen Connolly
We just learned that all of our attachments in ClickUp are available to the entire world if someone has the right URL. That's ridiculous and extremely dangerous! As another user pointed out, this is "security by obscurity" and I can't imagine it's actually GDPR compliant, even with "private attachments" turned on (since that still makes the attachments externally-available for an hour).
Please make this "feature" of externally-facing links a choice (e.g. an attachment should be totally private and protected, just like other ClickUp data, unless specifically set to share externally).
We actually may need to move away from ClickUp because of this. It's not something we can control -- if someone emails to a task (a critical feature for us), then any attachments in the email will become publicly-available files via this "external link attachments" feature.
From the ClickUp docs: "This is really cool because all files stored in ClickUp can be shared externally by copying the link to the file. By default, the link never expires and contacts can download the files from the link directly!"
This is NOT really cool! I mean, it could be cool in some scenarios, but it's pretty horrible, for the most part.