Platform Service Degradation - Comments Report Disabled

Update timeline

1. investigating May 07, 2026, 05:03 PM UTC

   We identified an underlying issue where the Comments card in the Campaign Performance Report was not consistently displaying the correct data. As a precaution, this card was temporarily disabled while our Engineering team investigated and resolved the root cause. This step was taken to ensure data accuracy and integrity.

2. monitoring May 07, 2026, 05:04 PM UTC

   The Comments card’s functionality has now been restored and is fully functional.

3. resolved May 07, 2026, 07:13 PM UTC

   Our monitoring indicates that the Comments card in the Campaign Performance Report continues to function as expected. This incident is now resolved.

4. postmortem Jun 05, 2026, 06:34 PM UTC

   ## Summary: On May 7th, 2026, we received reports that Studio users were able to see campaign titles, user names and email addresses, as well as comments made, that were not part of their program within the “Latest Comments” card or the Campaign Performance report. Following initial triaging and troubleshooting, a platform incident was declared, and the incident response team began looking at the reported issue. ## Severity: Sev-2 ## Scope: Any Studio user on the Firstup platform who accessed the Campaign Performance report directly from the Insights landing page, without the Content\_Id filter enabled. ## Impact: Studio users on the Firstup platform were able to see and download Personal Identifying Information \(PII\) for users outside their own program via the “Latest Comments” card in the Campaign Performance report. The exposed PII and other program information included: · Commenter’s first and last names · Commenter’s email address · Campaign publisher’s first and last name · Any PII contained within the raw comment text itself · Program ID ## Root Cause: The root cause for this incident was determined to be a regression from a configuration change that was released on April 24th, 2026, as part of a bug fix, which changed the format of the program\_id parameter, effectively removing the program\_id filter within the “Latest Comments” card, if a campaign\_id was not selected. However, if a campaign\_id was selected, the “Latest Comments” card would also filter to the campaign’s corresponding program\_id. ## Mitigation: To immediately mitigate data exposure, the “Latest Comments” card was reconfigured to return no results at 9:23 AM PT. A fix for the root cause was developed, tested, and released at 9:50 AM PT, and the “Latest Comments” card was restored to return program-specific results, which resolved this incident at 9:57 AM PT. ## Recurrence Prevention: As a recurrence prevention measure, we will be developing automated QA tests that will ensure all Insights reports return data that is specific to the program in which they are viewed and executed in, before any code changes are released to the production environment.