ClickUp Says Feature-Flag Misconfiguration Exposed 893 Customer Emails and an API Token
Summary
ClickUp says publicly queryable Split[.]io feature-flag configurations exposed 893 customer email addresses and one live workspace API token. It removed the emails, invalidated the token and plans automated checks for personal information and credentials.
Key points
- ClickUp said 893 customer email addresses were exposed through publicly queryable client-side feature-flag configurations.
- The configurations used Split[.]io client-side SDK keys and included customer emails in targeting rules.
- A live API token for one workspace was placed in a rate-limiting flag on October 7, 2025, and remained active until ClickUp invalidated it on April 27, 2026.
- ClickUp said a researcher report to HackerOne was incorrectly closed as a duplicate; later escalation attempts were caught by spam filters.
- ClickUp removed the exposed email addresses, invalidated the token and plans automated scanning to block personal information or credentials in feature flags.
- The article says no workspace tasks, documents, files, passwords or billing data were exposed.
Article Details
- Victim Organization
- ClickUp
- Incident Type
- Exposure of customer email addresses through publicly queryable client-side feature flag configurations, including exposure of a live API token.
- Incident Date
- 2025-10-07
- Data Types Exposed
- Customer email addresses
- API token
- Affected Records
- 893 customer email addresses and one API token
- Operational Impact
- The exposed email addresses were removed from feature flag configurations and the API token was invalidated. ClickUp reported that no tasks, documents, files, passwords, or billing data were exposed. The company was working with the affected customer to determine whether the token had been used for malicious access.
- Claim Status
- confirmed
Vendors
Products
ClickUpProductivity platform ClickUp disclosed a configuration oversight that exposed the personal information of 893 customers when client-side feature flag configurations became publicly queryable.Split.ioClickUp used Split.io client-side SDK keys and targeted customer emails in flag rules, making the data discoverable by design.