Verified Commit 14001591 authored by anarcat's avatar anarcat
Browse files

document the SNAFU with external participants

Closes: gitlab#157
parent 44e59cd8
Loading
Loading
Loading
Loading
+6 −0
Original line number Diff line number Diff line
@@ -1771,6 +1771,12 @@ An alternative would be to encrypt outgoing mails with PGP/MIME. Some
software that could do this was considered in the Schleuder
retirement, see [TPA-RFC-41](policy/tpa-rfc-41-schleuder-retirement#role-key-and-home-made-schleuder).

Note that this doesn't work with [external participants](https://docs.gitlab.com/ee/user/project/service_desk/external_participants.html), which can
be used to CC arbitrary email addresses that do not have a GitLab
account. If such an email gets added, confidential contents *will*
leak through clear text email, see the discussion in
[tpo/tpa/gitlab#157](https://gitlab.torproject.org/tpo/tpa/gitlab/-/issues/157).

## Issues

[File][] or [search][] for issues in the [gitlab project][search].