Urgent: Manager Bot overrides team permissions & exposes sensitive financial data

[salontas]

Hello community,

I am reaching out to see if any other business owners are experiencing a critical security issue with the Manager Bot integration on Square POS.

Currently, the bot appears to completely bypass role-based access controls and team permissions. Even when logged in under restricted employee profiles using personal passcodes, employees can still access the Manager Bot. Through the bot, users are able to pull up sensitive account information, including:

• Full financial and sales reports

• Employee details and payroll data

• Banking and payout information

There does not appear to be an option to set a PIN/passcode override specifically for the bot, nor a way to restrict its visibility by staff role.

Has anyone found a setting in the Dashboard to disable or restrict access to the bot for standard team members? If a Square team member is reading this, please advise on how to enforce strict owner-only permission controls for AI/assistant features.

Thanks for any insights or workarounds!

[Donnie-M]

@salontas I am checking on what I see.  Managerbot should follow the permissions of the person who is logged in.  Are you using device codes for your point of sale apps?