Commit
This commit does not belong to any branch on this repository, and may belong to a fork outside of the repository.
feat: link to release notes from orphaned tokens (#7731)
Adding a link "Read more in [release notes](https://github.com/Unleash/unleash/releases/tag/v6.1.0)" to orphaned tokens. This needs to be added on v6.1, with the following changelog entry: > **SDK tokens for deleted projects** > > In previous versions of Unleash, when a project was deleted, the associated SDK tokens were not removed. This issue has been addressed in the current version of Unleash. > > Unfortunately, if you deleted a project in the past without manually removing the associated tokens, these "orphaned" tokens were automatically converted to “wildcard” tokens, granting access to all feature flags across all projects. > > Our assessment indicates this poses a minor security concern due to the following reasons: > > This issue only affects tokens whose entire project scope has been deleted. > > Access requires knowledge of the token. > > SDK tokens have limited read access and must be assigned to a single environment. > > In the SDK tokens overview, orphaned tokens are flagged with a warning. We recommend discontinuing the use of these tokens and creating new, dedicated tokens instead. > > With the latest version, when a project is deleted, all API tokens scoped to that project will be removed as well. If you need further assistance, please contact customer support.
- Loading branch information