ClickUp Community

Hey, Tom, after hearing from our team, we're happy to share that we've recently updated our API to let users upload attachments to the File Custom Field! First, you'll need to run the 'Create an Attachment' API to generate the attachment/object ID, and then you can use it in the 'Set Custom Field Value' endpoint. (developer.clickup.com/reference/post…).

That after all those years in @clickup it's still not possible to upload files to a custom field via API, and this in time of AI and MCP connections is one thing. But the fact, that this is not even on the roadmap is surprising to say the least. feedback.clickup.com/public-api/p/c…

@zainzitawi Hey, Zain, on paid plans, you can give members and guests granular permissions for Folders, Lists, tasks, Docs, etc., but granular permissions at the Space level are Enterprise-only. We'd love to learn more about your use case, so we're reaching out to you via DM.

Anyone have a @clickup rep? I need granular permissions but I have like 12 people in my space lol. Not sure why I have to pay an extra $600 per year just to use this one feature 😭

@Zeerabets Wonderful to hear, Zeerabets! We sent you a DM to gather more details.

@ClickUpCrew Let’s do it

notion AI, coda AI, clickup AI — every productivity tool is now an AI tool and somehow they all got worse at the original thing. adding llms to everything is the new adding blockchain to everything. we learned nothing

@TomSolidPM Hey, Tom, we appreciate your honest thoughts and have shared them with the Product team. We're looking into this and will follow up shortly with an update.

@pogoda_michal Hey, Michael, if you’re experiencing crashes when using ClickUp, then we’d love to have our Technical Support team investigate! Please fill this form (help.clickup.com/hc/en-us/reque…) and DM us the ticket ID or email associated with your ClickUp account, so we can investigate.

@venturetwins Don't you have feeling that pressure to realease actually creates more bugs and less stable software? I mean all of my daily stack (clickup, cursor, slack etc.) recently became MUCH less stable. everything crashes, shitton of memory leaks...

One weird side effect of coding agents is I have much less patience for shitty software. There are no more excuses for a website / app to be lacking basic features or consistently buggy. Put your agent on it overnight!

@dougsillars Hey, Doug! Thanks so much for the feedback. Our product team has this feature in our radar! If you'd like to be updated about it, you can upvote and comment here: feedback.clickup.com/new-mobile-app…

hey @clickup - any chance for a speaker option when in syncups on mobile <whisper whisper whisper> I can't hear anything.

@clavitorai Hey, Clavitor, thanks for sharing this. Our Security team is aware of this and is currently looking into it.

ClickUp hardcoded an API key in their page source JavaScript. One GET request. 959 email addresses. 3,165 internal feature flags. Employees from Home Depot, Fortinet, Tenable, Mayo Clinic. The key was right there in the HTML. No scope. No rate limit. No expiry. Just a string anyone could copy. API keys are credit cards without spending limits and without a PIN code.

@weezerOSINT Thanks for bringing this to our attention, Impulsive. Our Security team is looking into this right now!

clickup is SOC 2 Type 2 certified. ISO 27001. ISO 27017. ISO 27018. ISO 42001. PCI DSS. every compliance badge you can buy. none of it caught a hardcoded API key leaking 959 customer emails for 15 months. none of it flagged a zero-protection SSRF on a free-tier endpoint. their own feature flag config documents their missing auth checks and its still active today. these certifications exist to tell enterprise customers "your data is safe with us." Home Depot, Fortinet, Tenable, Autodesk, Mayo Clinic, Rakuten trusted that. their employees' emails are in a publicly queryable API right now because of a key in the page source that clickup has known about since January 2025. if your company uses clickup, your employees emails might be in this response. the key is still live. anyone can pull it. @clickup rotate the key. it takes five minutes, its been 15 months.

i went to clickup.com. opened the page source. found a hardcoded API key in the javascript. copied it. sent one GET request. got back 959 email addresses and 3,165 internal feature flags. employees from Home Depot. Fortinet. Autodesk. Tenable. Rakuten. Mayo Clinic. Permira. Akin Gump. government workers from Wyoming, Arkansas, North Carolina, Montana, Queensland Australia, and New Zealand. a Microsoft contractor. 71 clickup employees. fortinet sells enterprise firewalls. tenable makes Nessus, the vulnerability scanner half the industry runs. their employees emails are exposed because clickup hardcoded a third party API key in a javascript file that loads before you even log in. this was first reported to clickup through hackerone on January 17, 2025. its now April 2026. the key has not been rotated. i just pulled the response five minutes ago. every email is still there. clickup raised $535 million at a $4 billion valuation. claims 85% of the Fortune 500 use their platform. looks like the proof is in the page source.

@arisagalua Hey, Arisagalua, we’d love to learn more details about your thoughts on using ClickUp for personal use. Feel free to DM us, and we’ll be happy to share it with our team for review.

ClickUp ... ああこれは以前挫折したYouTrackと同じ系統だ。個人使用にはオーバースペックだ。

Hey, there! ClickUp is more of an all-in-one Workspace than a single-purpose app. Because of that, it’ll naturally use more RAM than something like a single browser tab. Also, apps will use available memory to stay fast and responsive, so higher usage isn’t necessarily a bad thing unless your system is struggling. That said, it shouldn’t keep climbing or slow things down over time. If you’re noticing lag or memory usage that doesn’t stabilize, please let us know!

Now @clickup has bloated to 1GB of ram usage. What the fuck

Right now, new seat charges are tied to your existing subscription, and untangling those two things touches a lot of moving parts on our end (billing, access, payments, the works). That's why it works the way it does today, but your feedback genuinely helps us figure out what to tackle next, so thank you for flagging this! In the meantime, if you're thinking about adding seats down the road, emailing support@clickup.com beforehand can help make sure everything goes smoothly.

@ClickUpCrew Got it, billing is at workspace level. But what’s the rationale behind this? If existing users are already paid yearly, why should a failed payment for one new seat affect the whole workspace’s status? Why not just restrict the new user and leave paid users unaffected?

@clickup payments in India are a mess. Every time I add a user, payment fails because of @RBI e-mandate rules. Then I have to chase support to do a manual charge. Miss it once → they suspend the whole account. Not just the new user. Entire team. We’ve already paid yearly for existing users. Still everything gets blocked. So because of RBI + broken handling by ClickUp, businesses are forced into yearly payments + manual hacks just to keep things running. This is not a payment issue anymore. It’s operational friction.

Appreciate you pushing on this, Pradip. At a high level, billing is handled at the Workspace level (not per seat), so when a payment for a new user fails, it can flag the whole Workspace’s payment status. There is a 14-day grace period though, so access isn’t impacted right away. We’ve also shared more details and context with you in the DM thread we already have going since we’re not able to DM you directly here on X.

Thanks for the response and for escalating this. But I still don’t understand one thing: Why does a failed payment for one new user impact existing users for whom the yearly subscription is already fully paid? This is the core concern. Even if there are payment issues due to RBI or any other reason, shouldn’t the newly added user be the only one affected until payment is resolved? Why should already paid users lose access because of a new seat payment failure? Would really like clarity on this policy.

Appreciate you taking the time to share the details, Ashley, and have passed them to our team for review. In the meantime, we’d love to have our Technical Support team look into your backspace intermittently not working if you’re interested. Feel free to send a DM letting us know when this occurs (ex. entering the task title) and where (browser, mobile app, etc.), and we’ll take a closer look.

@DJ_CURFEW @clickup The most annoying is when my backspace key randomly stops working and when duplicate tasks appear and have to close and reopen it. No other task management software in the world is as pure shit as this.

.@clickup is by far the worst task management software I have ever used in my almost 30 year software engineering career. Fortunately you can use an MCP server and manage your tasks using AI, and don't have to use their absolute trash UI/UX anymore.

@ashleykZA Hey, Ashley! Open to sharing more about what's not working for you? We'd love to pass it along to our product team.

@shanefgtm @clickup Hey there! Supposedly, once you go through the OAuth flow, the access token is valid till the end of time. Could you give us more info on the flow you're seeing and the steps you're taking? Feel free to DM us and send screenshots/clips!

@clickup your api key rotation is way too aggressive, please give the user the ability to control timeline there. Every single time I try to hit it (every other day?) I have to go through the brain drain of your UI’s oauth. For the love of god fix it

@sanyampunia @clickup Hello, @sanyampunia! You can reduce memory usage on Mac by opening the Activity Monitor app and following the steps here: #h_01H9K2MZ9PH799PB7V4AVHNJWS" target="_blank" rel="nofollow noopener">help.clickup.com/hc/en-us/artic… We'll send you a DM to get more info about your desktop experience.

why is @clickup’s mac app straight-up hot dog shit? it guzzles memory doing the bare minimum. how does this garbage even exist in the market?

Jumping in for Gaurav! 👋 We definitely understand how important data backup and recovery are. In addition to our current options, our product team is actively exploring full export/backup solutions and will update the feature request as soon as there's more to share. We appreciate your feedback and have passed it directly to our product team!

@agarwal__gaurav Found many posts from you mentioning the importance of "financial backup". I hope @ClickUp will have a proper "DATA backup" and restore functionality available soon. Otherwise, all those wonderful features & AI agents r at risk. Will you make it happen? feedback.clickup.com/feature-reques…

8/ None of this works without product. You cannot market your way out of weak PMF. Distribution amplifies what is already true. If the product is undeniable, growth compounds. If it is mediocre, growth just exposes the cracks faster.

@adder_ko Hey, there! Sorry you’re running into that, definitely not the experience we want for you. We'll DM you so we can chat more directly and take a closer look.

why is clickup so fucking slow