Urgent: Manager Bot overrides team permissions & exposes sensitive financial data

salontas

Hello community,

I am reaching out to see if any other business owners are experiencing a critical security issue with the Manager Bot integration on Square POS.

Currently, the bot appears to completely bypass role-based access controls and team permissions. Even when logged in under restricted employee profiles using personal passcodes, employees can still access the Manager Bot. Through the bot, users are able to pull up sensitive account information, including:

Full financial and sales reports
Employee details and payroll data
Banking and payout information

There does not appear to be an option to set a PIN/passcode override specifically for the bot, nor a way to restrict its visibility by staff role.

Has anyone found a setting in the Dashboard to disable or restrict access to the bot for standard team members? If a Square team member is reading this, please advise on how to enforce strict owner-only permission controls for AI/assistant features.

Thanks for any insights or workarounds!

Donnie-M

@salontas I am checking on what I see. Managerbot should follow the permissions of the person who is logged in. Are you using device codes for your point of sale apps?

Donnie
Multi-Unit Manager | Founder, Table & Ledger
tableandledger.com

Square AI Champion | Using Square since July, 2017

"Good judgment comes from experience, and experience comes from bad judgment."

"You can have everything in life you want, if you will just help other people get what they want." - Z.Z.

"AI doesn't replace your judgment. It gives your judgment better information to work with."

christiangc757

Did we find a solution for this? Im experiencing the same. Square support over the phone have been no help. Extremely concerned as this is a breach of privacy

salontas

Hello Donnie,

Yes,

Before I reached out to dare support, any team member could access any information even though they were using their personal passcodes which have restrictions set.

After spending 2 hours with square support and sending them screen recording they accepted that this was a major issue.

they were able to fix the access on the mobile app, however we have a common team passcode (which has restricted permissions) and any one can access Managerbot on that.

i have set my POS IPad on airplane mode and I hope that no one will try to access Manager Bot in my absence.

Please have a passcode override as with other restricted information to Manager Bot.