Skip to main content
App security

Category: Productivity

Secure Notion browsing

Notion encrypts workspace data in transit and at rest. Browser risk comes from sharing and sign-in. Attackers have abused genuine Notion share emails.

Quick answer

Notion encrypts data in transit and at rest. Transit uses TLS 1.2 or higher. Stored data uses AES-256. Notion is audited for SOC 2 and ISO 27001. Its security page does not describe end-to-end encryption. In 2026, attackers sent sharing emails through Notion itself. The emails passed DKIM, SPF, and DMARC checks. They led to device code phishing aimed at Microsoft accounts. Verify unexpected shares through a second channel. Keep secrets out of pages.

Last updated

2026-10-30

Main browser risks for Notion

  • Sharing emails sent through Notion itself that lead to phishing pages.
  • Lookalike Notion share notifications that lead to fake sign-in pages.
  • Accidental exposure from public/shared pages and link permissions.
  • Copy/paste leakage of internal notes into untrusted tools or AI prompts in adjacent tabs.
  • Session hijacking risk when users authenticate and then browse risky destinations in the same profile.
  • Malicious links embedded in pages (external resources) that lead to malware downloads or credential harvesters.

Typical sensitive data in Notion

  • Internal documentation, runbooks, and policies.
  • Product specs, roadmaps, and engineering notes.
  • Customer meeting notes and account details.
  • Credentials or secrets accidentally stored in pages (high risk).
  • Embedded links to external tools, dashboards, and file shares.
  • Org structure and operational information useful to attackers.

How to check an unexpected Notion share

Based on Infosecurity Magazine's August 24, 2026 report on Sublime Security research, Notion's sharing help, and Microsoft's device code guidance. Checked October 30, 2026.
CheckWhy it mattersWhat to do
Who shared itGenuine Notion emails can carry an attacker's message.Confirm the share with the named colleague in chat or by phone.
Where it leadsThe 2026 lure moved from Notion to a PDF, then to an Adobe-styled page.Stop if a shared page sends you to sign in somewhere else.
Code promptsDevice code phishing uses Microsoft's real sign-in page.Never enter a sign-in code you did not request.
Who can open itA page set to Anyone on the web with link opens without a Notion account.Check a page's general access before you share it.

Based on Infosecurity Magazine's August 24, 2026 report on Sublime Security research, Notion's sharing help, and Microsoft's device code guidance. Checked October 30, 2026.

Recommended controls by role

Engineering

  • Never store secrets in Notion pages; use a secret manager.
  • Open unknown external links from Notion pages in isolation.
  • Use separate browser profiles for admin and daily browsing.

Security

  • Set workspace policies for guest access, public sharing, and exports.
  • Enforce SAML SSO on Business or Enterprise plans.
  • Block device code sign-in where your identity provider allows.

Executives

  • Verify unexpected “page shared” emails through a second channel.
  • Keep strategy notes out of outside tools and AI prompts.
  • Use phishing-resistant auth where available for high-risk accounts.

Where Shield fits with Notion

The controls above are general security practices, not Legba features. Notion is not a Legba integration.

Legba's part is narrow. Shield opens a page in an isolated browser off your device. Use it for a link you do not trust.

Limits

Shield moves page execution off your device. Downloads and copied data still cross that boundary. It cannot stop you sharing passwords with unfamiliar sites. Treat downloads and sign-in prompts with care.

Add to Chrome

Free for 30 days. No card required.

Notion security questions

Is Notion end-to-end encrypted?
Notion's security page does not describe end-to-end encryption. Data in transit uses TLS 1.2 or higher. Data at rest uses AES-256.
What should I do with an unexpected Notion share email?
Do not sign in from the email. Confirm the share with the sender by chat or phone. In 2026, genuine Notion emails led to device code phishing. Never enter a sign-in code you did not request.
Can a public Notion page leak internal data?
A public link can expose it. Notion calls the setting Anyone on the web with link. Anyone holding that link can view the page. Viewers do not need a Notion account. Link access can be set to expire. Enterprise owners can disable public links.
Does Notion support SAML SSO?
Yes, on the Business and Enterprise plans. Owners can require SAML SSO for verified-domain members. Notion also lists SCIM for user provisioning.

References

  1. 01
    Notion SecurityNotion
  2. 02
    Notion Help: Sharing and permissionsNotion
  3. 03
    Notion Help: SAML SSO configurationNotion
  4. 04
    Infosecurity Magazine: Doubloon Dredger abuses Notion to harvest tokens (August 24, 2026)Infosecurity Magazine
  5. 05
    Sublime Security: Doubloon Dredger, Notion abuse, and EvilTokensSublime Security
  6. 06
    Microsoft Learn: Authentication flows in Conditional AccessMicrosoft

Keep exploring

Try it on the next page you do not trust

Legba is a Chrome extension with two modes. Ghost gives you a private browser route. Shield opens a page in an isolated browser off your device.

Add to Chrome

Free for 30 days. No card required.

Ghost. A private route for your browser. Shield. An isolated browser, off your device. Choose the mode. Close when finished.