We’ve made it easy to manage if user and company custom data attributes (CDAs) can be created by the Messenger, improving the security of your workspace.
We recommend that you disable CDA creation via the Messenger by following the steps below.
What is the security risk?
Customers can send lots of user and company data into Intercom through the Messenger. However, this allows for bad actors to insert their own data through the browser. This can update existing user and company CDAs as well as create new attributes.
For example, if identity verification isn't enabled, bad actors can do this for other customers, potentially enabling them to access other customers' data. They can also manipulate their own CDAs for self gain, like changing the value of an order to increase a refund amount.
Preventing the security risk
There are two effective ways to prevent a bad actor from abusing attributes:
Enable identity verification to help prevent impersonation.
Prevent the Messenger from creating CDAs (see below).
Prevent the Messenger from creating CDAs
To ensure your workspace is secure, we recommend you do not allow user or company CDAs to be created via the Messenger.
Attribute creation by the Messenger can be disabled easily in your workspace settings.
Navigate to Settings > Data > People data. Find the setting to "Allow custom data attributes to be created via Messenger" at the top of the page and toggle this off.
This will disable it for both user and company custom data attributes.
In addition to this setting, we strongly recommend enabling identity verification to improve the security of your workspace.
Need more help? Get support from our Community Forum
Find answers and get help from Intercom Support and Community Experts