# RSS Opens View Access to Anyone

**URL:** <https://kanboard.discourse.group/t/rss-opens-view-access-to-anyone/3547>\
**Category:** Open Discussions\
**Created:** [September 17, 2025, 6:05pm UTC](https://kanboard.discourse.group/t/rss-opens-view-access-to-anyone/3547 "2025-09-17T18:05:55Z")\
**Posts on this page:** 4\
**Page:** 1

<div class="post-metadata">

**Author:** ![Daboo](https://avatars.discourse-cdn.com/v4/letter/d/439d5e/32.png) [@Daboo](https://kanboard.discourse.group/u/Daboo)\
**Post date:** [September 17, 2025, 6:05pm UTC](https://kanboard.discourse.group/t/rss-opens-view-access-to-anyone/3547/1 "2025-09-17T18:05:55Z")

</div>

I’ve been evaluating Kanboard for use within our organization, love the simplicity and was getting it setup and configured in preparation for launch when I discovered the “Public Access” feature. Any user, regardless of permissions can enable an RSS feed, then, anyone with that link can see the feed. What that means, is if someone either inadvertently enables the feed and shares it out of convenience or someone decides to maliciously share it, The organization’s projects can be easily seen in the wild. It would be nice if this feature could be disabled by the admin for security reasons.

---

<div class="post-metadata">

**Author:** ![alfredb](https://yyz2.discourse-cdn.com/free1/user_avatar/kanboard.discourse.group/alfredb/32/1051_2.png) [@alfredb](https://kanboard.discourse.group/u/alfredb)\
**Post date:** [September 18, 2025, 7:56am UTC](https://kanboard.discourse.group/t/rss-opens-view-access-to-anyone/3547/2 "2025-09-18T07:56:33Z")

</div>

> [@Daboo](#):
>
> Any user, regardless of permissions can enable an RSS feed

A regular user can only enable his personal feed. To avoid this, I’d remove the _Public access_ section from the users _My profile_ sidebar.

---

<div class="post-metadata">

**Author:** ![Daboo](https://avatars.discourse-cdn.com/v4/letter/d/439d5e/32.png) [@Daboo](https://kanboard.discourse.group/u/Daboo)\
**Post date:** [September 18, 2025, 2:39pm UTC](https://kanboard.discourse.group/t/rss-opens-view-access-to-anyone/3547/3 "2025-09-18T14:39:35Z")

</div>

Thanks for your feedback. The only way I see to do this is to make changes in the code which could be undone the next time an update for the app comes out. Am I missing something?

---

<div class="post-metadata">

**Author:** ![alfredb](https://yyz2.discourse-cdn.com/free1/user_avatar/kanboard.discourse.group/alfredb/32/1051_2.png) [@alfredb](https://kanboard.discourse.group/u/alfredb)\
**Post date:** [September 19, 2025, 7:44am UTC](https://kanboard.discourse.group/t/rss-opens-view-access-to-anyone/3547/4 "2025-09-19T07:44:36Z")

</div>

> [@Daboo](#):
>
> could be undone the next time an update for the app comes out.

Of course you’re right. Nevertheless, I think it’s the easiest way. Personally, I’m keeping such patches at hand for fixing some annoyances. Currently none for Kanboard 😉

A possibly better way is writing a plugin that overloads the template in charge. But then you might run into other trouble.

Finally, the clean way might be securing the feed with authorization, even if it’s no longer public then.