Skip to content

[P0] Audit: Pipeline Builder share/export privacy boundary is not visible enough #100

Description

@baixiangcpp

Imported from the byteflow.tools deep audit on 2026-06-22.

Problem: Pipeline Builder states that save/export/share keep workflow structure and public options only, but this privacy boundary is easy to miss. Because recipes often handle logs, JWTs, JSON payloads, and URL-encoded data, users need strong confirmation that runtime input, outputs, logs, and secrets are excluded.

Affected URL:

Reproduction steps:

  1. Open /en/pipeline-builder.
  2. Use a built-in recipe such as Security token review or Log scrub before sharing.
  3. Paste dummy sensitive-looking input.
  4. Run the recipe.
  5. Click Save, Export JSON, and Share URL.
  6. Inspect exported JSON, generated URL, localStorage, and sessionStorage for runtime input.

Expected behavior: before saving, exporting, or sharing, the UI should explicitly show what is included and excluded. The user should see that only step configuration and public options are shared.

Actual behavior: the privacy note exists, but it is not prominent enough at the exact moment the user shares or exports a recipe.

Impact: users may avoid the feature because they distrust sharing, or worse, they may share without understanding the boundary. This weakens the core privacy-first promise.

Proposed fix:

  • Add a pre-share confirmation panel listing included fields and excluded fields.
  • Add a “Privacy preview” drawer that shows the exact JSON payload before export/share.
  • Ensure runtime input, final output, run log, and constant step input are stripped by tests.
  • Add warnings when step option values appear sensitive.
  • Add documentation explaining share URL semantics.

Acceptance criteria:

  • Export JSON and Share URL actions show a clear privacy preview.
  • Automated tests prove runtime input/output/log content is absent.
  • localStorage does not persist sensitive runtime data by default.
  • Share URLs remain valid and contain only recipe structure/options.
  • The UI clearly states “runtime input is excluded” beside the share action.

Metadata

Metadata

Assignees

No one assigned

    Labels

    No labels
    No labels

    Projects

    No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions