Skip to main content
We believe in responsible disclosure. This page acknowledges security researchers who reported vulnerabilities to us and documents issues that have been remediated. Unless otherwise noted, there is no known evidence of exploitation prior to remediation.
TLDR: A crafted in-app notification could cause the desktop app to open an unexpected page and access session information. We deployed a server-side fix within a day of the report, with additional hardening in the next desktop release. The vulnerability was fixed before it impacted any users. We found no evidence of exploitation, no users were affected, and no customer action is required.

​
What Happened

A security researcher we collaborated with, Alex Schapiro, reported a vulnerability to us on June 23, 2026. The vulnerability affected how certain in-app notifications were rendered in the Granola desktop app. Granola notifications can take you directly to relevant content, such as a private note another user has shared with you. To exploit this, a malicious user would need to locate the link to a private note that hadn’t been shared with them, request access to it, and craft their profile name so it rendered as a clickable link inside one of these notifications. If a user then clicked that link, the desktop app could be directed to an external page. Because of how the app handled navigation at the time, that page could access the signed-in session and locally available data. We investigated the report the same day it was received and deployed a server-side fix protecting all users the following day. After the researcher identified a bypass on June 25, we addressed it on June 26, and they confirmed the vulnerability was fully resolved on June 29.

​
How We Fixed It

We fixed both the specific method used in this vulnerability and the underlying navigation issue:
  • Server-side (June 24–26, 2026): added sanitisation to user-controlled text in notifications, such that they are rendered as plain text. This protected all users without requiring an app update.
  • In the desktop app (June 24–28, 2026): added a guard preventing any app navigation to an untrusted URL.

​
Impact and Guidance

Our logs showed no evidence this issue was exploited beyond the proof-of-concept reported to us by the researcher. Exploitation would have required targeting a specific user to generate a notification (for example, by sharing a private note), making it difficult to exploit at scale. Questions? Contact us at hey@granola.so

​
Acknowledgements

Thank you to Alex Schapiro (Strix.ai) for responsibly disclosing this issue, providing a clear proof-of-concept, confirming the fix, and collaborating constructively throughout.