Data spillage exposure radius docs - #9138
Conversation
Co-authored-by: Copilot Autofix powered by AI <175728472+Copilot@users.noreply.github.com>
Co-authored-by: Copilot Autofix powered by AI <175728472+Copilot@users.noreply.github.com>
There was a problem hiding this comment.
Pull request overview
Adds Mattermost documentation for the new “post exposure” (exposure radius) CSV report in the Data Spillage / quarantined message review workflow, including how to obtain it, what it contains, and what it can and can’t prove.
Changes:
- Adds a new reviewer action to download an exposure report and links it to new guidance.
- Updates the quarantined message ZIP report documentation to include
exposure_report.csvand describe its role. - Introduces a new “Generate a post exposure report” section covering report interpretation, limitations, and performance considerations.
💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.
|
Newest code from mattermost has been published to preview environment for Git SHA a27dc44 |
|
No actionable comments were generated in the recent review. 🎉 ℹ️ Recent review info⚙️ Run configurationConfiguration used: Organization UI Review profile: CHILL Plan: Pro Run ID: 📒 Files selected for processing (1)
🚧 Files skipped from review as they are similar to previous changes (1)
📝 WalkthroughWalkthroughThe content flagging guide now documents post exposure report downloads, report archive format 1.1, CSV fields, exposure rules, access restrictions, localization, sorting, limitations, and report generation behaviour. ChangesContent flagging reports
Estimated code review effort: 1 (Trivial) | ~5 minutes Mergeability Score: ⚪ Minimal · up to This documentation-only change has no actionable merge-blocking risk remaining and is merge-ready after normal checks and review. 🚥 Pre-merge checks | ✅ 5✅ Passed checks (5 passed)
✨ Finishing Touches🧪 Generate unit tests (beta)
Comment |
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 4
Caution
Some comments are outside the diff and can’t be posted inline due to platform limitations.
⚠️ Outside diff range comments (1)
source/administration-guide/manage/admin/content-flagging.rst (1)
118-145: 🔒 Security & Privacy | 🟠 Major | ⚡ Quick winAdd secure handling guidance for report files.
These sections show that report files can contain message content, attachments, user IDs, usernames, and email addresses. The page describes reviewer access but does not explain how administrators should store, transfer, or retain downloaded files. Add a
warningadmonition before the archive structure.Suggested RST addition
Each quarantined message report is a ZIP archive containing YAML metadata files, a CSV exposure report, and the original file attachments. +.. warning:: + Report archives and exposure reports can contain message content, attachments, + user IDs, usernames, and email addresses. Store and share them only in approved + locations with least-privilege access. Apply your organisation's retention and + secure-deletion requirements.As per coding guidelines, documentation must include secure handling practices for sensitive data and use a
warningadmonition when the consequence is security exposure.Also applies to: 188-205
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In `@source/administration-guide/manage/admin/content-flagging.rst` around lines 118 - 145, Add a warning admonition immediately before the archive structure describing secure handling of downloaded reports: restrict access to authorized personnel, use secure storage and transfer, and follow applicable retention and deletion policies because files may contain sensitive message content, attachments, user IDs, usernames, and email addresses. Apply the same guidance to the corresponding report-file documentation section referenced by the comment.Source: Coding guidelines
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In `@source/administration-guide/manage/admin/content-flagging.rst`:
- Line 216: Update the report stability guidance around the row-order statement
to qualify that ordering is deterministic only for an unchanged user population
and usernames. Note that username changes or deleted accounts can alter row
order or count, and instruct downstream tooling to identify rows by User ID
rather than position.
- Around line 152-159: Change the admonition directive preceding the post
exposure report limitations from important to warning, preserving the existing
explanatory content and list unchanged.
- Around line 207-214: Update the exposure classification guidance around “Last
viewed channel at” to require the value to fall within the reporting window: at
or after “Post created at” and at or before “Flagged at.” Clarify that values
after “Flagged at” must not be classified as possible exposure, while preserving
the existing handling for earlier and unknown/N/A values.
- Around line 138-140: Update the documentation for report_metadata.yaml and
exposure_report.csv to explicitly distinguish the archive format version from
the exposure CSV schema version. Use labels matching the metadata and generated
CSV files, identifying 1.1 as the archive format version and 1.0 as the exposure
CSV schema version.
---
Outside diff comments:
In `@source/administration-guide/manage/admin/content-flagging.rst`:
- Around line 118-145: Add a warning admonition immediately before the archive
structure describing secure handling of downloaded reports: restrict access to
authorized personnel, use secure storage and transfer, and follow applicable
retention and deletion policies because files may contain sensitive message
content, attachments, user IDs, usernames, and email addresses. Apply the same
guidance to the corresponding report-file documentation section referenced by
the comment.
🪄 Autofix
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: Organization UI
Review profile: CHILL
Plan: Pro
Run ID: a9db42e8-6a81-44c4-8f3e-bd3ae8619eb4
📒 Files selected for processing (1)
source/administration-guide/manage/admin/content-flagging.rst
- Qualify the exposure report with its v11.11 availability in the reviewer action list and in the archive contents summary - Distinguish the archive format version (1.1) from the exposure report's own version (1.0) - Add secure-handling guidance for downloaded report archives and exposure reports - Raise the exposure report interpretation caveat from important to warning - Bound possible exposure by the reporting window, and explain what a Last viewed channel at value after Flagged at does and doesn't establish - Qualify row-order stability and tell downstream tooling to match on User ID - Describe the Go csv.Reader Comment field in prose rather than as syntax Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
|
Newest code from mattermost has been published to preview environment for Git SHA 4b695e1 |
|
Newest code from mattermost has been published to preview environment for Git SHA 3d86ac4 |
|
@harshilsharma63 - Thank you for the docs! When you get a chance, can you help update to the appropriate server release milestone? |
|
@Combs7th done. I've added the milestone now |
Combs7th
added
3: Reviews Complete
Summary
Added docs for post exposure radius report.
Ticket Link
Fixes https://mattermost.atlassian.net/browse/MM-70063