Slack is one of the hottest startups out there right now, after having won over a wide range of tech companies with its enterprise collaboration tool. Usually that would be a good thing, except that different projects those companies are working on might have been exposed thanks to a “feature” that makes team names visible to unauthenticated users.
Earlier, the feature in question allowed anyone to sign up using any random email address at a specific domain, and then prompts them to select teams that are available at their company. That’s great for creating a fast onboarding workflow for users, but not so great when any random person can spoof an email address at a company’s domain and have unauthenticated access to a list of teams.
Slack says the visibility of those team names was not entirely its fault. In a statement, the company points out that team discoverability via email domain is a setting team owners and administrators can control. It can also be set so that users can join by invitation only, which Slack says will not make team names visible to all.
That might be the case, but it’s silly to blame users for a setting that probably should have been turned off by default. While it might have resulted in fewer employees immediately signing up for teams if they needed to be invited, the unintended consequence of exposing top-secret projects is probably a much bigger issue for its customers.
That’s not to say the company doesn’t realize there’s a problem with its sign-on process. In the statement, Slack acknowledged that as companies have added more and more teams, the sign-in process has become more cumbersome anyway. As a result, it’s looking to refine that process to streamline onboarding, as well as adding features like single sign-on to address other issues.
UPDATE: Slack has since updated sign-in on desktop, and says a change is also in the works for its mobile apps, which it hopes to have live over the coming weeks. The company said that the change will make team names no longer visible when a user signs in, while it overhauls the entire sign-in process.
That doesn’t seem like a quick fix, however, and In the meantime the company says it will be reaching out to clients to clarify settings and how they affect whether or not team names are visible to unauthenticated users. That is, if those team admins aren’t already aware of the issue thanks to all the news about it.
Here is Slack’s statement in its entirety on the subject:
