Repository navigation
docs(legal): list the email about a linked Linear account - #97
Merged
kalaspuff merged 1 commit intoOct 30, 2026
Merged
Conversation
kalaspuff
approved these changes
Oct 30, 2026
kalaspuff
deleted the
fctl/573-run-a-thorough-full-security-pass-of-the
branch
October 30, 2026 21:42
kalaspuff
pushed a commit
to hyperstructure/fctl
that referenced
this pull request
Oct 30, 2026
## Summary What a linked Linear account delegates to fctl, or mentions fctl in, starts sessions as its fctl person, on their Claude subscription, and its replies reach their sessions' agents. With a stolen browser session or token, someone could link their own Linear account to the victim's fctl account, with nothing to confirm and nothing said to the person, and go on starting the victim's sessions from Linear, reading what they do there, long after the stolen token was revoked or the password changed. Linking a Linear account is now a sensitive action (`Sensitive::LinkLinear`), as connecting a Claude subscription became in #326: where the primary instance owner turned on confirming it's you, it takes a passkey or a code. The app's "Link your Linear account" buttons (Settings and a project's Tickets tab) confirm before they go on to Linear; a link opened elsewhere (Linear's own button in an agent session, `fctl account linear connect`) goes back to Settings with "Linking a Linear account takes confirming it's you", where linking again confirms first. A new link also emails the person when email is set up, naming the Linear account and saying what it does. Verified in `cargo xtask dev`: with confirming turned on and an authenticator app on the account, an unconfirmed session's `GET /api/v1/linear/link` goes back to `/settings?linear=confirm#linear`, and after `POST /api/v1/auth/verify` it goes on to Linear's sign-in. The web tests for the Tickets tab and the outcomes pass, and `cargo xtask check --quick` passes. The email needs an instance with email, which the dev stack isn't. The privacy policy lists the new email since: - hyperstructure/fctl-site#97 ## Worth confirming - **Decision:** like every sensitive action, this asks only where confirming it's you is turned on, which is off by default; elsewhere the email is what tells the person. - **Decision:** a link from Linear's own button that needs confirming lands on Settings rather than taking up the agent session that asked for it; after linking from Settings, fctl still takes up the delegations that waited for that Linear account. ## Stacked pull requests The fixes before this one in this security pass are on main; the next ones build on this one: - #358 - #359 - #360 [fctl session](https://app.fctl.sh/s/ses_01M677K9YMM5WPZBTAR2KKXMSZ) <!-- FCTL_REVIEW_SUMMARY --> --- > [!NOTE] > **Medium risk.** It adds a confirm-it's-you check to linking a Linear account, which changes an authentication-adjacent flow for everyone who links one; a mistake could block linking or let a stolen session link an account. > > **What it does.** Linking a Linear account lets Linear delegations start sessions as the person, so `GET /api/v1/linear/link` now requires the same sensitive-action confirmation as connecting a Claude subscription, where the instance asks for it. The web app confirms before sending people there, and Linear's own button is redirected back to Settings to confirm. A notice email is also sent when an account is linked. > > **New outcome and email.** Linking now has a `confirm` outcome shown in Settings and sends a best-effort email to the person; docs/security.md and docs/architecture.md are updated. > > <sub>[fctl review](https://app.fctl.sh/s/ses_01M67D37HF57SP912A3YYJK0WN)'s first look at [`393e78c`](393e78c) · 10 files, +173 −11 · [Review agent settings](https://app.fctl.sh/p/fctl?tab=reviews)</sub> <!-- /FCTL_REVIEW_SUMMARY --> --------- Co-authored-by: fctl-sh[bot] <343971779+fctl-sh[bot]@users.noreply.github.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
app.fctl.sh now emails people when a Linear account is linked to their account, as it does when a Claude subscription is connected, since what that Linear account delegates to fctl then starts sessions as them. The privacy policy's list of notice emails names it, and its updated date moves to today.
The fctl change that sends it:
fctl session
Note
Low risk. It only edits the privacy policy text and its updated date.
What it does. Adds linking a Linear account to the list of account changes that trigger a notice email in the privacy policy, and bumps the policy's
updateddate to 2026-10-30.fctl review's first look at
d1fbde6· 1 file, +3 −3 · Review agent settings