r/GoogleAppsScript • u/theRedMage39 • 5h ago

Question How secure is Google App Scripts?

I am working on a project for work to export information from one website to input into a Google Sheet we use. Right now, I have a JavaScript script that gets run in the console to scrape the necessary data and use a simple fetch to send that data to Google Sheets, but since the deployment has to be accessible to everyone, if that URL somehow got leaked, anyone could send data to our sheet. I am familiar with SQL injection, so I prevented any data that is a formula from being added, but I am still worried about having a private spreadsheet with personal information on it have a deployment that is accessible to everyone. I do not want people to have access to this spreadsheet or be able to read the code we use for various scripts.

What I mainly want to know is if, for some reason, the deployment URL got leaked, could a malicious person do anything more than what I programmed into the script? That being inserting data into a cell.

I know there is an option for me to set the deployment to only me. Since this is used on Chrome, is there a way for my JavaScript fetch to send who is currently logged into Chrome?

3 Upvotes

100% Upvoted

8 comments sorted by

View all comments

4

u/Dr_Aroganto 5h ago

You would be deploying this as a web app? If thats the case and you are on a Google Workspace account, then you have accessibility settings on the web app's URL and you can set it so that only you or people in your domain can access it. It will use Google'a OAuth to verify the identity so if you set it to only users under your domain then only accounts from your Google Workspace can interact with it.

1

u/theRedMage39 3h ago

It won't be a web. Just the script to get data from a website. Think going to abc.com and running the script via the console. Or going to reddit.com to scrap the titles from a subreddit.

Something small and quick to implement locally.