The short answer
On April 27, 2026, ClickUp disclosed that 893 customer email addresses had been embedded in feature-flag targeting rules and that one flag improperly referenced a customer API token. ClickUp said the flag configuration was publicly queryable through the browser-side Split.io SDK architecture and that the customer information should never have been stored there. [1]
ClickUp reported no exposure of tasks, Docs, files, passwords, billing data, or its authentication systems, apart from the potential workspace impact of the single exposed token. Its log review found no malicious access beyond the researcher’s investigation. ClickUp invalidated the token on April 27 and confirmed removal of all customer email addresses from flag configuration by April 28 at 03:25 UTC. [1]
This record covers ClickUp’s April 2026 disclosure about customer information embedded in client-readable feature-flag configuration. It does not describe a compromise of ClickUp authentication systems or a general exposure of workspace content. [1]
Classification: Data became accessible to unintended people because of a bug or configuration error. Learn how incident terms differ.
Classification
Data exposure through client-readable feature-flag configuration; not a confirmed intrusion into ClickUp systems [1]
Email addresses
893 customer email addresses embedded in targeting rules [1]
Credential exposure
One customer API token improperly referenced in a rate-limiting flag [1]
Workspace content
ClickUp reported none exposed, with potential impact limited to the workspace associated with the single token [1]
Observed misuse
ClickUp said its logs showed no malicious access beyond the researcher’s investigation [1]
Remediation
Token invalidated April 27; customer emails removed by April 28 at 03:25 UTC; all 4,809 flags audited [1]
Incident timeline.
-
Initial SDK-key report
A researcher reports the browser-side Split.io SDK key. ClickUp says that report correctly received an informational classification because a public browser SDK key is expected and the report did not include the later-disclosed email addresses or API token. [1]
-
Expanded impact reported through HackerOne
The researcher files a new report documenting 893 customer email addresses in targeting rules, the live customer API token, and other operational data. On April 10, a HackerOne triage analyst incorrectly closes it as a duplicate of the earlier SDK-key report. [1]
-
Public disclosure and incident response
After escalation messages were filtered, the researcher discloses publicly at about 10:42 UTC. ClickUp becomes aware at 11:06 UTC, declares an incident, invalidates the customer token, cleans feature flags, and completes an automated audit of all 4,809 flags that day. [1]
-
Customer email cleanup completed
ClickUp confirms at 03:25 UTC that all customer email addresses have been removed from feature-flag configuration and publishes process changes covering sensitive-data rules, report review, and security-email filtering. [1]
What was exposed — and what ClickUp says was not
The confirmed exposed data consisted of 893 customer email addresses used to target feature rollouts and one customer API token placed in a rate-limiting flag during an API-abuse response. Because browser-side feature flags must be retrievable by the client, anyone able to query that configuration could potentially read values that engineers had treated as internal. [1]
ClickUp drew a narrow scope around the incident: no tasks, Docs, files, project data, passwords, billing data, or authentication systems were exposed. The exception was the single API token, which made data in its associated workspace potentially reachable according to the token’s permissions. ClickUp said it was working directly with that customer and found no malicious access beyond the researcher. [1]
Why the configuration became public data
The browser SDK key itself was public by design; that was not the vulnerability ClickUp ultimately confirmed. The failure was putting personally identifiable information and a credential into feature-flag definitions that the client SDK architecture made queryable. ClickUp said engineers treated the configuration as internal tooling even though the browser needed to retrieve it. [1]
The response was also delayed by process failures. ClickUp says HackerOne incorrectly closed the materially expanded April 8 report as a duplicate, and later escalation emails and social messages were caught by filtering. ClickUp did not become aware of the expanded impact until the researcher disclosed publicly on April 27. [1]
ClickUp’s response and remaining scope caveat
ClickUp invalidated the token, removed customer emails, prohibited PII and credentials in feature-flag configuration, audited all 4,809 flags, and announced secondary review of bug-bounty reports plus changes to security-email filtering and reviewer training. [1]
The finding of no malicious access is a vendor statement based on ClickUp’s log investigation, not proof that the values were never read elsewhere. ClickUp said it would update the disclosure if new information emerged and directly notified people whose email addresses appeared in the configuration. [1]
What ClickUp customers should take from it
ClickUp says it contacted every customer whose email address was present. Customers who received no notice were not in that set. Because passwords were not exposed, this event alone does not establish a need for a password reset; affected users should nevertheless be alert to targeted messages using their ClickUp-associated address. [1]
The customer associated with the API token requires different treatment because a token can authorize workspace API access. ClickUp invalidated that token and said it was working directly with the affected customer to verify whether any improper access occurred. [1]
How SealTask relates to this incident class
This incident is not a clean example of something end-to-end encryption would have prevented: customer email addresses and API credentials sit outside encrypted task content. SealTask likewise keeps account and operational metadata server-visible. For a disclosure limited to stored workspace content, SealTask stores protected task data as client-encrypted ciphertext; that narrower property does not protect exposed account data, credentials, active sessions, clients, or devices. [3]
Frequently asked questions.
Was ClickUp breached in 2026?
ClickUp disclosed a data exposure, not a confirmed intrusion into its systems. Client-readable feature-flag configuration contained 893 customer email addresses and one customer API token. ClickUp reported no compromise of authentication systems and no general exposure of workspace content. [1]
What information was exposed?
The confirmed values were 893 customer email addresses in feature-targeting rules and one customer API token in a rate-limiting flag. ClickUp reported that passwords, billing data, authentication systems, and other customer tokens were not exposed. [1]
Was ClickUp workspace content exposed?
ClickUp said no tasks, Docs, files, or project data were exposed generally. The single API token created a potential exception for its associated workspace, but ClickUp’s log review found no malicious access beyond the researcher. [1]
How did ClickUp fix the issue?
It invalidated the token, removed customer email addresses from feature flags, audited all 4,809 flags, prohibited PII and credentials in flag configuration, and announced bug-bounty and security-email process changes. [1]
Related records
Sources
All sources last accessed . Corrections: email hello@sealtask.com with a source and we will review and correct.
- 01 ClickUp Security Team: “April 27th – What happened with our feature flag configuration” - Primary vendor disclosure — affected data, technical cause, bug-bounty timeline, observed-access finding, and remediation
- 02 Have I Been Pwned: breached-sites index - No product-attributed ClickUp entry located; checked against the live index on July 13, 2026
- 03 SealTask security architecture - What SealTask encrypts client-side and which account and operational metadata remain server-visible
Prefer task content protected at rest?
SealTask encrypts task titles, notes, comments, and attachments before upload. A compromise limited to stored server data would expose ciphertext for that content; account metadata, active sessions, client delivery, and devices remain separate risks.