It seems that since a recent app update, our "Balance -> Transfer Report" page is now plainly visible to all staff, even though permissions are turned off for this. All staff can now go through all of our bank transfers and also have to option to initiate an immediate transfer to our bank account at a cost.
Am I missing something? I've called for help on this an it appears that it needs to be escalated to the engineers. I couldn't get any fix.
I have 2 levels of permissions, Owner and Team. Team has all reporting and balance permissions turned off. It seems as though there would normally be a requirement to enter a passcode to see the pages in these areas, but the default page for the "Balance" area is the "Transfer Reporting" page, and this opens up to view. The other areas like "Loans" are still passcode protected. Looks like a horrible, horrible, confidential-information-sharing bug to me. Extremely angry about it, but I'm suspending that until I can confirm that it is not my error.
This is extremely concerning and I expect square engineers to fix this immediately. It is important that we be able to protect our business information. If square cannot keep our information confidential, we we will be unable to continue using square’s services.
