Easily embed different kind of charts and diagrams to your boards, items and workdocs!
Mermaid Charts and Diagrams provides widgets (for boards, items and workdocs) that turns textual descriptions into beautiful diagrams. A documentation of the textual description can be found here https://mermaid-js.github.io/mermaid.
FEATURES
⭐ Flow charts, sequence diagrams, class diagrams, state diagrams, entity relationship diagrams, gantt diagrams, pie charts, git graphs, user journeys, mindmaps, timelines, C4 diagrams, quadrant charts, requirement & Sankey diagrams.
⭐ Syntax validation, error highlighting & live preview
Does the developer periodically perform penetration testing?
Not answered
Does the developer have a dedicated security and privacy point of contact for such issues or questions?
Not answered
Does the app restrict redirects and forwards only to approved destinations, or show a warning when redirecting to potentially untrusted content?
Yes
The app does not include any redirect logic. All links within a diagram are opened in the parent window (and not in the app's element).
Does the app protect against mass parameter assignment attacks?
Yes
The client-side technology the app is relying on is not vulnerable to “mass parameter assignment attacks”.
Does the app perform encoding and sanitization on all user supplied parameters to protect against Cross-Site Scripting?
Yes
User data is processed by the 3rd party library Mermaid which includes a sanitizer logic and our apps explicitly sets the Mermaid security level to “antiscript” (see https://mermaid.js.org/config/usage.html#securitylevel).
Does the developer protect all state-changing actions against Cross-Site Request Forgery (CSRF)?
Yes
State changes are performed via monday.com's Software development kit (SDK) (https://developer.monday.com/apps/docs/introduction-to-the-sdk) which includes a seamless authentication logic.
Does the developer have mechanisms to notify monday.com in case of a security breach?
Yes
If we discover a security breach, we immediately contact [email protected] and provide all available information.
Does this developer have a process for installing application-level updates and security patches for the service (such as software packages and databases)?
Yes
The app is a client-side only app which is hosted in the monday.com environment, i.e., the builds for all features (item view, board view and dashboard widget) are implemented with monday's “upload” mechanism. We regularly update the client-side dependencies via standard npm features (such as “npm audit”).
Compliance
Is the app certified with the information security standard ISO/IEC 27001:2022?
Not answered
Is the app compliant with the Health Insurance Portability and Accountability Act (HIPAA)?
Not answered
Is the app certified with System and Organization Controls (SOC 2 or SOC 3)?
Not answered
Is the app compliant with the General Data Protection Regulation (GDPR)?
Not answered
Data
Does the app send any data outside of monday.com? If yes, indicate whether the data is customer-submitted (e.g., board names, item names, doc content) or non-customer-submitted (e.g., account ID, board ID, user ID).
Not answered
Where does the app store logs data?
Not answered
Where does the app store the app data?
Not answered
Does the developer ensure application logs do not contain secrets or personally-identifiable information (PII)?
Yes
The app is a client-side only app hosted in the monday.com environment which does not create any logs. Logs created by the app's webhook handling lifecycle events do not contain any sensitive information, i.e., all personal data such as names or e-mail addresses are stripped out before persisting the data.
Is customer data segregated from the data of other customers (for example logically or physically)?
Yes
All customer data is stored in the monday.com environment and accessed within the app via the storage API (see https://developer.monday.com/apps/docs/mondaystorage).
Privacy
Does the developer enforce multi-factor authentication on employees access to systems which may process customer data?
No
Customer data created in the app (i.e., diagrams) are stored within the monday.com ecosystem and are not accessible by weweave. Customer data collected by the app's webhook handling lifecycle events is only accessible with a private SSH key or by decrypting the backups with a shared secret.
Does the developer protect access to customer data based on the principle of least privilege?
Yes
Only the two partners of the company have access to customer data.
Reviews
No reviews yet.
Installation history
We have data for December 28, 2024 onwards only. Collected sometime after 00:00 UTC daily.