Culture

Zoho Writer search bug exposed private documents

A flaw in the Office suite temporarily enabled users to view documents pulled into search results that were not shared with them, raising the issue of data privacy in online office suites.

A bug surfaced during development of a group-oriented search feature allowed me to view Zoho documents created by other people that were not intentionally shared with me.

Zoho fixed the bug on Sunday, after I reported it, and said its impact was limited. Still, as a user, it made me think twice about putting private documents online.

On Sunday morning, I went up to my Zoho Writer page and searched on "soccer." The results included two of my documents, but also seven others created by people I didn't know.

I reported the incident to a Zoho technology evangelist, who swiftly escalated the issue to the company's engineering team. After a few correspondences, the Zoho team identified the bug and fixed it.

The reason I saw documents that were not shared with me is because Zoho is adding a feature to search on shared documents.

The system had one bug under a specific scenario, according to company engineers. The index had been running only for a few hours, but Zoho stopped it to do another round of quality assurance testing, I was told.

To Zoho's credit, its people apologized and clearly recognized the seriousness of the bug. The problem came up because of a situation that's not likely to come up often. But it does give me pause. Did somebody else stumble upon my documents?

Overall, I enjoy having Web-based documents, even when the product is in beta test version, as Zoho Writer is. But the incident raises questions of privacy and underscores the importance of trust between a consumer and Web service provider.