15 million Trello users' email addresses exposed through an unsecured API. Separately, thousands of "public" Trello boards containing passwords, API keys, and confidential business plans are indexed by Google. People don't realise "public" means "on the internet." Their project board with database credentials is one Google search away. Passwords. API keys. Database credentials. Business strategies. All sitting on public Trello boards, indexed by Google. The UN. UK government agencies. Major corporations. Years of sensitive data, one Google search away, because Trello defaulted to "Public" and nobody checked.
Police can demand location data for everyone near a crime scene
Spying
0/4 N/A
Is someone spying on me?
Data Sharing
1/4 LOW
Who gets my data?
Security
2/4 MODERATE
Is it actually secure?
Honesty
2/4 MODERATE
Can I trust what they say?
ACCEPTABLEModerate concerns. Standard privacy hygiene applies.
2Contradictions
0Critical
2High
0Medium
2Sources
Findings by concern
Security2/4 MODERATE2 findings
⚡ highmarketing vs third party research
15 million Trello users' email addresses exposed through an unsecured API. Separately, thousands of "public" Trello boards containing passwords, API keys, and confidential business plans are indexed by Google. People don't realise "public" means "on the internet." Their project board with database credentials is one Google search away.
What they claim: Trello promotes easy, visual project management for teams
What we found: Trello boards set to "Public" are indexed by search engines, and researchers have found thousands of boards containing passwords, API keys, business plans, personal data, and confidential project details accidentally exposed to the internet. A 2024 breach of Atlassian data exposed email addresses of 15 million Trello users through an unsecured API that allowed bulk email enumeration.
⚡ highmarketing vs third party research
Passwords. API keys. Database credentials. Business strategies. All sitting on public Trello boards, indexed by Google. The UN. UK government agencies. Major corporations. Years of sensitive data, one Google search away, because Trello defaulted to "Public" and nobody checked.
What they claim: Trello promotes easy collaboration for teams
What we found: Security researchers discovered thousands of Trello boards accidentally set to "Public" containing passwords, API keys, SSH credentials, database connection strings, business strategies, and personal data — all indexed by Google. The UN, UK government agencies, and major corporations were among those with exposed boards. Trello's default for new boards was changed to "Private" only after years of public exposure incidents.