trello

The next time you type something sensitive into a Google Doc—or any other online tool with a sharing feature—be careful about the permissions you grant. Speaking with The Register , the founder of QR generation service Pageloot said that he learned that the hard way. Siim Kostabi recalled how a contractor working for the company accidentally exposed login details for its staging environment—credentials that were never meant to leave an internal testing setup. The hapless developer had access to a staging environment (used to test new software code before it goes live). They stored the login details in a Google Doc and then set it to “anyone with the link can view.” It turns out Google Search can index Google Docs with that setting if the link becomes discoverable on the public web. “Anyone with the link” files aren’t automatically indexed, so we don’t know exactly how Google discovered this particular document. What we do know is that it did: The credentials file ended up in Google Search. A Pageloot developer typed the company’s domain into Google while debugging, and Google’s autocomplete feature surfaced a staging hostname followed by what looked like a credential string. Sure enough, the document was accessible online. Google Search was surfacing information from a document that had been shared too widely. To its credit, Pageloot moved quickly. It cut the contractor’s access and changed every affected credential. It also banned password storage in Google Docs, Slack, Notion, and any other shared workspace. The problem is that none of those fixes existed before autocomplete surfaced the password. If nobody had spotted it, the credentials could have remained exposed. People share private data in online tools all the time If there was ever an example of why you should use a password manager, this is it. Instead, the contractor typed their login details into a Google Doc, presumably to keep them handy. Pageloot isn’t alone in dealing with this problem. Ateam, a Japanese Android game developer, left a Google Drive instance set to “Anyone on the internet with the link can view” from March 2017 until November 2023. That single misconfiguration exposed 1,369 files and personal data for 935,779 people. Ateam said it had seen no evidence anything was taken, though seven years of open access is hardly reassuring. Scale AI, the data-labeling company central to Meta’s AI ambitions, also left 85 Google Docs with training material for Meta, Google, and xAI editable to anyone with a link. Contractors called the setup “incredibly janky”. Scale later disabled users’ ability to share managed documents publicly. This is a trend. Three years ago, AI security company Metomic scanned approximately 6.5 million Google Drive files and found that 40.2% contained sensitive information. Just over a third were shared externally, while 0.5% were fully public. That 0.5% might not sound like a lot, but across 6.5 million files, it still represents thousands of publicly accessible files. This isn’t just a Google problem, though. People accidentally share sensitive information through other tools too, like the Trello project management system. Making a Trello board public makes it viewable to everyone, which was unfortunate for government users when they exposed passwords and security plans that way in 2018. The problem is that as tools become increasingly collaborative, people can’t keep up. They make mistakes. Verizon’s 2025 Data Breach Investigations Report attributes around 60% of breaches to human factors including misconfiguration and misuse of valid credentials. What the checkbox cost Pageloot encountered another access-control failure involving a customer. A disgruntled former employee whose access had never been revoked used it to redirect the customer’s QR codes to a competitor’s site. It was the same root cause: nobody was watching who had access to what. Kostabi learned his lesson, which is to keep an eye on who has access to what. Consumers can take a few simple precautions too. Don’t store passwords or other highly sensitive information in ordinary shared documents. Use a password manager for passwords, and before hitting Share in any online service, check exactly who will be able to access what you’re sharing. “One of the best cybersecurity suites on the planet.”   According to CNET.  Read their review →

Fake troubleshooting tip on ClawHub leads to infostealer infection A new malware delivery campaign has hit ClawHub, the official online repository for “skills” that augment the capabilities of the popular OpenClaw AI agent. Unlike previous ones, this campaign does not aim to trick users into downloading a bogus, malicious skill. Instead, the threat actor is leaving this particular comment on popular legitimate skills published by others: The malicious troubleshooting comment “At first glance, this appears to be a troubleshooting suggestion. It is not. It is a malware loader,” the OpenGuardrails research team warns. When the Base64-encoded payload is decoded, it reaveals a commang that downloads a shellcode loader from 91[.]92[.]242[.]30, removes macOS quarantine attributes, and delivers and executes the Atomic macOS (aka AMOS) infostealer. OpenClaw’s VirusTotal-powered scanning recently added to the repository won’t catch this threat, as it analyzes skill packages, not comments. “This payload was delivered as encoded text inside a comment, which significantly reduced [the likelihood of detection by users and security scanners],” the OpenGuardrails team noted. The IP address from which the malware is downloaded has previously been linked to the ClawHavoc malware distribution campaign, during which the threat actor leveraged instructions in the skill documents to push users to run a downloaded “agent” or paste Terminal commands (and thus download and run Windows or macOS malware). The malicious comments are currently found underneath the most downloaded skills in the ClawHub repository – e.g., Trello, Slack, Gog, etc. – and some users and skill publishers are already warning about them and asking for the user account posting them to be banned. OpenGuardrails’ Thomas Wang warning about the malicious comment (Source: OpenGuardrails) This latest campaign is likely to be far less successful than earlier ones – if for no other reason than that OpenClaw users are, hopefully, more cautious now, and the security community is keeping a more watchful eye on this growing repository. Subscribe to our breaking news e-mail alert to never miss out on the latest breaches, vulnerabilities and cybersecurity threats. Subscribe here!

Every day, businesses, teams, and project managers trust platforms like Trello, Asana, etc., to collaborate and manage tasks. But what happens when that trust is broken? According to a recent report by Statista, the average cost of a data breach worldwide was about $4.88 million. Also, in 2024, the private data of over 15 million Trello user profiles was shared on a popular hacker forum. Yet, most organizations and project managers still assume that their platform's built-in backups are enough until they are not. The next few paragraphs will expose some risks of relying on these platform tools alone and how to better protect yourself and your organization from data loss with cloud backup and recovery. Why are project management tools becoming a prime target for data loss? More than 95% of businesses today rely heavily on project management tools like Trello and Asana to organize tasks, collaborate with teams, and track project milestones. However, as project managers become more deeply integrated into these tools for their daily operations and storing massive data volumes in one place, two major threats arise: human errors and cyber threats. Tiny human errors that cause massive data disasters Data is one of the most critical assets of every organization. It helps them understand customer behaviour, market trends, and internal performance. Also, for project managers, it provides insight into project timelines, risk management, resource allocation, and team productivity. When used effectively, it can be used to forecast business sales and revenue. However, while cyberattacks and natural disasters can lead to data loss, the human element is the most common cause. For example, teams and project managers that juggle multiple tasks and deadlines in a shared workspace create ample room for accidental deletions and mistakes. Also, according to a study conducted by the Computing Technology Industry Association (CompTIA), human error accounts for 52 percent of the root causes of security breaches. Other common human errors include misconfigured user permissions, unintended bulk actions, archiving projects too early, etc. The growing threat of cyberattacks Most project management tools today are cloud-based, enabling teams to collaborate remotely. However, they have also become attractive to cybercriminals. Cyberattacks such as phishing and ransomware are targeting these platforms with a lot of sensitive information that might cripple a business if found in the wrong hands. For instance, data reports by DocuClipper have it that "60% of small businesses that are victims of a Cyber Attack go out of business within six months". That is why you, as a project manager, need the proper information security to protect your data from such threats. Are built-in security features enough to protect your project data? The answer is No! And here is why. While most SaaS-based project management tools like Monday com, Trello, and Asana have basic built-in features such as role-based access control, data encryption, and authentication, they are not fully designed to protect against costly mistakes caused by human error. For project managers, this could mean the difference between staying on schedule and facing expensive delays. Limitations of native security project management tools No version history or rollback. Many project management tools don't offer full versioning, making restoring to the previous state difficult. Limited recovery windows. Platforms like Asana retain deleted tasks for 30 days. After that, it is permanently deleted without a trace. Basic trash bins aren’t enough. For instance, if a team member accidentally deletes a task, and it's not caught quickly, it might be impossible to restore such a task. Lack of protection against internal mistakes. Built-in features cannot stop major errors like accidental deletion of an entire board or misconfiguration of settings. Third-party backup: the missing layer in your SaaS project management tools Project managers and team leaders must be proactive when dealing with SaaS tools. And that includes having a third-party cloud backup for business. While SaaS project management platforms are efficient and feature-rich, they are vulnerable and are not immune to data loss. The rising cyber-attack threats, human error, compliance, and audit readiness have made third-party backup solutions essential for data protection. Leverage FluentPro Backup for Project Management Software FluentPro Backup is one of the best cloud-based backup and restore tools for project management software. Whether it is Monday.com backups, Asana, Smartsheet, Trello, Microsoft Planner Basic, Planner Premium, Microsoft Dynamics Project Operations, or Microsoft Dataverse database, the backup tool is designed to automate end-to-end data protection without requiring manual intervention from project managers or team leaders. Also, one of the defining strengths of FluentPro Backup is its ability to minimize data loss due to accidental deletion, sync error, or third-party integration failures. Capabilities of FluentPro Backup for SaaS project management tools Automated continuous backup. FluentPro Backup provides 100% automated backup that runs continuously and saves project versions. Quick restoration of projects. FluentPro Backup offers quick and automated recovery. For example, if a project was deleted due to human error or a cyber-attack, the software provides a one-click full project restore to minimize downtime and disruption. Granular restore. Project managers or teams sometimes don't need to restore an entire project, just a specific file or task. FluentPro Backup offers granular recovery options that allow you to restore individual items, subtasks, or labels. Enterprise-grade security measures. At the core of FluentPro Backup is project management software security. Understanding the importance of data security, the software protects your projects from unauthorized access and breaches. For instance, the software uses Microsoft Azure to store data with full compliance standards. Version control and audit trails. Version history is one of the outstanding features of FluentPro Backup software. The solution keeps historical snapshots of project data, which allows you to compare and restore changes between versions. Also, there is an audit trail that logs every backup and restores your SaaS project management tools. What real-world value does FluentPro Backup bring to businesses? Ensures project continuity. Always showing up is the most important thing for all businesses out there. This uninterrupted flow supports better project delivery outcomes and preserves client trust. Boosts team confidence and productivity. Project managers and teams can work productively when they know every task and project is backed up securely. Minimize operational and financial risk. Some of the most critical risks associated with data loss include costly delays, damaged reputations, and lost contracts. However, with FluentPro Backup, you can minimize this risk to the barest minimum without impacting business operations. Enhance stakeholder trust. Stakeholders and clients are the backbone of every business venture. You want to ensure that they are always happy doing business with you. You can assure them by demonstrating your backup and recovery strategies using the FluentPro Backup tool. Conclusion While SaaS project management tools like Monday.com, Asana, Trello, and Smartsheet are widely used for collaboration and task tracking, they come with several project management challenges that can compromise project data integrity and availability. However, by taking a proactive approach to project management security, you are well-positioned for any cyber threats or tiny human errors that might cause downtime, financial loss, and reputational damage. So don't wait until data loss disrupts your project workflow; invest in secure tools like FluentPro Backup to protect your project data and ensure your team and organization peace of mind.