microsoft / microsoft/Power-CAT-Copilot-Studio-Kit
Adaptive card gallery using "no authentication" setting is a security risk
Open
Nobody has claimed this yet.
help wanted
- Dominant language
- TypeScript
- Stars
- 450
- Forks
- 95
- Avg merge
- 26m
- Merged PRs (30d)
- 5
Description
The adaptive card gallery is deployed with "No authentication" setting and this is getting flagged and classed as a security risk in our organization. One major concern is that this opens the door for malicious copilot credits usage attacks.
Since we deployed the kit as a managed solution, it would be time consuming and challenging fixing this and getting back to a safe state. We therefore would like to request an update to the managed solution so that the adaptive card gallery uses Entra ID authentication out of the box.
Contributor guide
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Assessment
This issue has not been assessed yet.