This is more for workato team. I know we can set up permission so that a recipe is not by default available in the community.
Each recipe by default comes with a sharing URL, which is useful for sharing and for support.
However the URL is open (if you have it), and the string after โstโ is not very long. So...I am wondering if there could be some malicious users harvesting the recipes by trying random recipe numeric number and the token.
I know the chance of getting a hit may be low but ... you never know. Canโt underestimate the super computerโs power ๐
I am wondering if this is on workatoโs radar? I can see a few options:
Boxโs approach:
1. Set up policy to auto expire share links after x days
2. Allow token regeneration ad-hoc
3. Allow manually extending the sharing period
Oktaโs approaxh: disable sharing altogether and when workato support needs to get in, grant just in time access globally, or only to the recipe.
Thoughts?
