Known security risks

[Jaymassena]

This is used for now to track known gaps in our security.

[Jaymassena]

• Invites do not expire: We could add an expiration timestamp and require that now <= timestamp for an invite to be considered valid for group/channel membership.
• Invites can be forwarded: They are like golden tickets that can be used by anyone who possesses it but it can only be used once.
• We rely on firebase security throttling to protect against massive user account spamming.

[Jaymassena]

As of 2.2

• Branch invite links are good forever: We could add an expiration timestamp and require that now <= timestamp for an invite to be considered valid for channel membership. We could also use a branch feature that make a link good for one use only.
• Branch invite links can be forwarded: They are like golden tickets that can be used by anyone who possesses it.
• We rely on firebase security throttling to protect against massive user account spamming.