NetSendo v2.8.5: Brain API Now Respects API Key Permissions
API keys are meant to work like keys to particular rooms. A key you give to a reporting tool so it can read subscribers shouldn't also open the room where your bot tokens and third-party API keys are kept. In NetSendo before v2.8.5, the Brain API could be opened that way.
NetSendo v2.8.5 (released 2026-11-09) fixes this. The Brain API now checks the permissions on each API key. Brain has its own permissions, and saved secrets are no longer sent out of your server. If you self-host NetSendo, you should install this update soon.
/api/v1/brain/* accepted any valid API key, whatever permissions it had. v2.8.5 adds brain:read and brain:write permissions and replaces saved secrets with secret_hints (the last four characters). The queued CSV export now requires subscribers:read. Keys with full access keep working without changes. Narrower keys lose Brain access until you add the new permissions to them.
🔐 What's New in v2.8.5
The Problem
The Brain endpoints under /api/v1/brain/* checked only that an API key was valid. They didn't check what the key was allowed to do. A key limited to something like subscribers:read could still:
- Read Brain's settings, which included the Telegram bot token and the Perplexity and SerpAPI keys in plain text
- Change Brain settings
- Edit the Brain knowledge base and plans
The issue was reported privately by realtasty. Thank you for the responsible disclosure.
The Fix
Dedicated Brain Permissions
brain:read and brain:write are now available under Settings → API Keys.
Secrets Stay on the Server
Saved secrets aren't included in JSON responses from the API or in the data sent to the panel page.
Secret Hints
secret_hints shows the last four characters of each saved secret so you can tell which key is configured.
Export Permission Check
POST /api/v1/lists/{list}/export now requires subscribers:read, the same as the inline export.
How Existing Keys Are Handled
- Keys with full access are given
brain:readandbrain:writeautomatically. Their integrations keep working. - Keys with narrower permissions lose Brain access until you add the Brain permissions to them.
- Connection tests for Perplexity and SerpAPI still work if you leave the key field empty. NetSendo tests the saved key on the server.
ℹ️ Note: If any of your tools read Brain secrets from the API or the panel page, they will now receive secret_hints instead of the full values. Store secrets in NetSendo and let the server use them.
💼 Who This Affects: Three Examples
E-commerce: Store Integrations
Say your store syncs customers through a key that can only work with subscribers. Before v2.8.5, anyone who got hold of that key could also read your Telegram bot token and AI provider keys. After the update, the key can do only what its permissions allow.
SaaS: Brain-Driven Automations
If an onboarding or churn-prevention workflow reads Brain plans or updates the knowledge base through a scoped key, give that key brain:read, and brain:write if it changes anything. Otherwise those calls will start failing after the upgrade.
Agencies: Per-Client Keys
If you give clients or contractors their own keys, Brain access is now a choice you make for each key. A reporting dashboard can have read-only access to subscribers without seeing the AI configuration.
🛠️ Step-by-Step Upgrade Guide
-
Back Up and Update
Back up your database, then update to v2.8.5 using your usual upgrade process. For a typical Docker install, that looks like this:
docker compose pull docker compose up -d -
Review Your API Keys
Go to Settings → API Keys. Keys with full access already have the Brain permissions. Look closely at every key with narrower permissions.
-
Grant Brain Permissions Only Where Needed
For each integration that really uses Brain, add
brain:read. Addbrain:writeonly if the integration changes settings, the knowledge base or plans. -
Check Export Integrations
Tools that call
POST /api/v1/lists/{list}/exportnow needsubscribers:read. If a scheduled export stops working, check this permission first. -
Replace Code That Reads Secrets
If a script used to read full secrets from Brain settings, change it to use
secret_hintsto confirm which key is configured. -
Test Connections
In the Brain settings, run the Perplexity and SerpAPI connection tests without typing a key. NetSendo checks the saved key on the server.
⚠️ Common pitfall: After the upgrade, a Brain call made with a narrow key returns a permission error. This means the fix is working. Add the Brain permission to that key; don't switch the integration to a full-access key.
🎯 Expert Tips
🎯 Expert Tips
If you shared narrow API keys with third parties before v2.8.5, those keys could read your Brain secrets. As a precaution, rotate your Telegram bot token and your Perplexity and SerpAPI keys.
Give each key the smallest set of permissions it needs, and use one key per integration. If one key leaks, you can revoke it without breaking your other integrations.
Full-access keys get the Brain permissions automatically. Check whether each one really needs full access, and narrow it down if it doesn't.
When you rotate secrets, compare the last four characters in secret_hints to confirm the new key is in use.
✅ Conclusion
v2.8.5 is a small update with a big security impact. The Brain API now has its own permissions, saved secrets stay on your server, and the queued CSV export requires subscribers:read. Full-access keys keep working without changes. For narrower keys, add the Brain permissions only where they're needed.
Self-hosting means your data and your credentials stay on your own server, so updates like this one are worth installing quickly. For more details, see the documentation and review your connected tools on the integrations page.
Update to v2.8.5 Today
Update your instance, then review your API keys.
