Joining Public Playbook gives access to Private Channel

Troubleshooting
1

Hi, all.
Maybe this is not a bug, but it was unexpected. I have a self hosted community server (v9.2.3).

If you happen to run a playbook in a private channel, then a user can find the run, join/participate the run, and gain access to that private channel via the @playbooks BOT adding them to the private channel.

This for me is a privacy issue I was not expecting to encounter.
Probably one solution is to get the enterprise version that provides private channels, but it’s not in our budget possiblities. And again, I did not expect that this would be possible in private channel.

Is there anyway to prevent this behaviour?

Thank you.
Matt

2

Granular playbook permissions is a feature of our Enterprise product Feature List | Mattermost

3

Thank you for your response, John.

Okay, that is what I suspected. However, I was hoping for some kind of workaround. The fact that “Every Private channel is accessible if it has a Public Playbook,” seems counterintuitive to me. Even the idea of Public Playbooks giving the option to create a Public or Private run channel seems moot under this finding.

4

One mitigation is to have each run of the playbook start it’s own private channel. That way, you aren’t exposing any private comms outside of the playbook run.

5

Not exposing, but that private channel is joinable by anyone who joins the playbook run.
It just takes someone to go through each run and find the ones with private channels.

Anyway, I suspect not many people are aware of this issue and maybe some warning should be made when running a public playbook in a private channel.