Here is a summary, by way of a hypothetical scenario, that clarifies the root cause issue/flaw we are seeing in the Monday.com platform:
- Jim makes two private boards: Projects and People
- He creates a two-way link (connected boards) column so he can see which people are on the projects and vise versa.
- Jim invites 10 of his favorite co-workers to the boards to collaborate.
- Jim’s new co-worker, Bill, see the Projects board structure and thinks to himself, ‘I could use this for another task I have to do at work, I’m going to duplicate what Jim created on the Projects board because it’s so nicely setup and that will save me a lot of time.’
- Bill duplicates the Projects board (with structure and items) and call the duplicate board, Bills Projects, which he marks as a private board and doesn’t invite anyone else to, since it is for his own private use.
- Bill doesn’t realize that Bills Projects is still connected to the People Board, or at least, he moves on without paying much attention to it. Maybe he decides to use a different strategy for managing his tasks and forgets to delete the new board he created… it is after all a private board… it shouldn’t matter is he doesn’t delete it right away right? (hint… wrong)
- Jim opens the People Board, expecting to see the linked column to the Projects board with various mirrored columns, but to his surprise, they’re gone! He checks activity, no one deleted anything, the data is just “gone” with no explanation or reason. Jim is confused because he was the only owner of the board and he had permissions set to prevent anyone from modifying the board structure.
- The reason that the linked columns to the Projects board are “gone” is because Bills Projects is also linked to People, so the Monday.com permissions logic wants to prevent Jim from seeing Bill’s private data in the connected boards/mirrored columns, but in doing so, it hides all connected boards and mirrored data from Jim and his team.
- This opens up a horrible issue – there is nothing Jim can do to secure his boards other than plead and ask his team not to duplicate them, but we all know that’s not a reliable solution at scale. It also allows for someone to maliciously render boards useless if they’d like, simply by duplicating boards, which anyone can do if they just add themselves to a workspace (which anyone can do for most subscription levels of Monday.com)
- Jim painstakingly figures out what happened… by no intuitive means available, but just through luck and communication with his team. Jim and Bill rectify the issue, but the automations are broken now in the process and need to be setup once again.
I hope this has conveyed how critical an issue this is to proper use of boards. In my opinion, a linchpin feature of Monday.com is the connected boards column type. However, if users are not able to setup two-way connections without major risk to board integrity, this poses a large operational risk for the platform.
The best known workaround to date is to add workspace permissions to prevent anyone but workspace owners from creating private/shareable boards. I believe this still exposes the edge case of two public boards with a two way connection, one getting duplicated, moved to another workspace, and then made private. So ultimately the hole still exists. Even with this workaround that removes the main cause of the issue, it also costs the entire team the ability to create private/shareable boards in a workspace, which is not ideal.