Freshservice Work Next Security

Architecture

Work Next is a Freshworks-hosted full-page app with an administrator installation-settings page. It has no PezTech-operated Work Next backend, external database, scheduled refresh, webhook, external analytics, advertising, billing or telemetry service.

Read-only permissions

The app requests exactly freshservice.tickets.view and freshservice.tickets.conversations.view. It uses Freshworks OAuth request substitution and does not require a customer API key.

Work Next provides no ticket write operation. It cannot reply, assign, change priority or status, send a reminder, create a note or close a ticket.

Request and resilience controls

• Retrieval is scoped to tickets assigned to the signed-in Freshservice agent.
• Pagination is bounded and duplicate or repeated pages fail closed.
• A normal refresh pipeline is capped at 45 request-method calls.
• Authentication failures stop further traffic.
• Rate limits produce a cooldown without automatic retry storms.
• Failed conversation requests are isolated and affected tickets are not confidently ranked from missing evidence.
• Changing Smart View is local and does not fetch another ticket list.

Validation and isolation

Work Next validates the current Freshservice host context and strict ticket and agent identifiers before requests or native opening. Configuration, response and cache structures are validated; malformed or contradictory evidence is rejected conservatively.

Cache records carry the validated Freshservice host and are not reused after the account context changes. Agent-specific keys separate derived records within the installation, while Freshservice remains responsible for permissions and account authorisation.

Safe presentation and diagnostics

Ticket subjects, configuration labels and API-supplied values are rendered as text rather than trusted HTML. User-facing errors use curated categories instead of raw API bodies. Support information is displayed locally and is not automatically transmitted to PezTech Software.

Dependency posture

The browser application has no production npm runtime dependencies. Release validation includes locked development-tool installation, dependency auditing, behavioural tests and Freshworks validation. No security certification or guarantee of absolute security is claimed.

Report a security issue

Email support@peztechsoftware.co.uk with a clear description and safe reproduction steps. Do not include credentials, OAuth configuration, authorisation headers, private conversations or information you are not authorised to share.