---
title: Members can no longer test channels, edit organization preferences or list API keys
description: A member could send test notifications through any channel, change organization-wide notification preferences and see the list of API keys, although those are…
canonical: https://watchfor.io/changelog/2026-09-05-member-permissions
---

[All updates](/changelog/page/4#2026-09-05-member-permissions) 🔒 Security Sep 5, 2026 · v 6.8.1

# Members can no longer test channels, edit organization preferences or list API keys

A member could send test notifications through any channel, change organization-wide notification preferences and see the list of API keys, although those are owner and admin duties. That gap is closed: channel tests, organization preferences and the API-key list are owner/admin only, members see generic webhook URLs masked, and an action they may not take is shown disabled with the reason instead of failing. Members still acknowledge incidents, write internal notes and draft post-mortems. Also closed: channel URLs pointing at internal addresses.

## What changed for members

Action Owner or admin Member

Acknowledge incidents, write internal notes, draft post-mortems yes yes

Send a test notification through a channel yes no, shown disabled

Change organization-wide notification preferences yes no, shown disabled

See the list of API keys yes no, the tab is hidden

See full generic webhook URLs yes masked

## Why it matters

A test notification reaches real people: it can page whoever is on call at three in the morning. A generic webhook URL often carries a secret token, so anyone who can read it can post to that endpoint. And a member who sees a disabled button with Owners and admins only knows who to ask, instead of hitting an error.

## Example

A contractor you invite as a member can acknowledge incidents, add notes and draft the post-mortem. They can't send a test page to your on-call engineer, and they can't copy the webhook URL that posts into your incident bot.

## Also closed

Channels whose delivery URL points at a private or internal address are refused, both when you save the channel and again when a message is sent.

The full list of who can do what is in [Roles](/docs/organization#roles).

Share this update

---

Canonical page: https://watchfor.io/changelog/2026-09-05-member-permissions · Site guide: https://watchfor.io/llms.txt