3 ms·
This is extremely problematic for us. We're bootstrapped and now Google is suddenly asking for up to $75,000 (or more) for a security audit. This despite the f
by Alex3917 8y ago
This is extremely problematic for us. We're bootstrapped and now Google is suddenly asking for up to $75,000 (or more) for a security audit.
This despite the fact that we've been publicly asking for more limited OAuth scopes for years (c.f. my HN posting history and my tickets on the Google issue tracker), and the fact that we've had zero security incidents in over three years. All to ensure that we're not risking exposing user data that we don't even have, have never accessed, and shouldn't need access to in the first place.
https://cloud.google.com/blog/products/g-suite/elevating-user-trust-in-our-api-ecosystems https://cloud.google.com/blog/products/g-suite/elevating-use...
- kitx 8y agoAppears that (wording is somewhat vague) apps which only store user data on the device do not need to go through this external security assessment. Agree that this is Google pushing their security costs onto developers and effectively killing bootstrapped SAAS apps.
- wastedhours 8y agoDoes this limit things like Zapier integrations as well? Surely they can't confirm the end security of every usage?
- Alex3917 8y ago> Surely they can't confirm the end security of every usage? If attachments are going from Gmail to Google Docs then they're probably fine, I'd imagine one audit could cover all those types of apps. For things that send email to Slack or whatever I'd expect that Slack would need to pay to have that audited.
- wastedhours 8y agoI used to work in a place where we had Trello boards, database integrations, and spreadsheets all triggering emails through Gmail (via Zapier) - it was startup-hacky, but it worked.