Linear's post-mortem: a permissions bug exposed private-team metadata for an hour

Posted: 7 April 2026 · Category: Productivity & Workflow

On 6 April Linear published a post-mortem on its 24 March incident: a code change broke a permission filter, exposing metadata across private teams for roughly an hour before it was caught and rolled back.

What changed

The short version from Linear's own write-up: a change to permission-filtering logic meant information that should have stayed inside private teams was visible beyond them for about an hour. The exposure was metadata — not, on Linear's account, document contents — and the company has published what failed and what it's changing.

Credit where due: the post-mortem is prompt and specific, which is more than many vendors manage. But the incident class matters more than the handling. Permission filters are the load-bearing wall of every multi-tenant SaaS product — when one fails, "private" quietly stops meaning private, and no amount of encryption helps because the system itself did the showing.

What it means for Australians

For Australian teams, metadata is not nothing. Issue titles, project names, and team structures routinely contain client names, unannounced products, and deal references — the kind of material an NDA exists to protect. If your workspace held sensitive client work in late March, read the post-mortem and decide whether anything in your titles alone would worry you.

The broader lesson applies well beyond Linear: when you evaluate any SaaS tool for confidential Australian work, the question isn't only "where is the data?" but "what happens when their access controls fail — and do they tell you?" Linear told. Plenty wouldn't have.

What we're watching

The remediation items in the post-mortem actually shipping, and how this weighs against Linear's otherwise strong engineering reputation when we assess it for Australian professional use — reliability incidents like this one belong in the score, not the footnotes.

Sources

• Linear — incident on Mar 24th 2026 (post-mortem, 6 April 2026): https://linear.app/now/linear-incident-on-mar-24th-2026 (primary) [Wayback snapshot TBC]

The AI Directory Australia is independent. We review and score AI tools for Australian users — AUD pricing, AU availability, data residency, GST. We don't write ads; affiliate links are disclosed and sponsored content is labelled. Edited by Adam.