Hello Paul,
Thank you for your reply and explanation regarding our reported issue. We understand that when accessing Domino data through backend methods such as the C API or Java API, UI-level design restrictions (e.g., Hide/When formulas) are bypassed, and that these formulas are not intended to prevent programmatic access to data. We also acknowledge that any data visible in the Document Properties → Fields tab can be read programmatically, even if it is hidden in the UI.
However, in our testing, we found that even when a database’s Default ACL access is set to Author, and the user has not created the target documents, it is still possible to read document content through COM or Java APIs. This behavior appears to differ from our understanding of the intended Author-level restrictions.
In real-world environments, due to the large data volume and the number of applications involved, it is not practical to implement Readers field controls on all sensitive fields—maintenance costs and complexity would be too high. We have also confirmed, using simple COM and Java test programs, that as long as the user has a valid Notes ID and the database ACL is set to Author, they can retrieve all documents in the database in bulk, bypassing both UI restrictions and Readers field enforcement. This indicates a protection gap in Domino’s current ACL model at the API level.
We agree that field-level encryption can protect sensitive data, but in our current environment, implementing it across all applications would require significant development and operational resources. Therefore, we still believe Domino should provide a database-level option to selectively block or restrict direct access via COM/Java APIs, to reduce the risk of unauthorized programmatic data retrieval.
Additionally, you suggested opening a formal case for further investigation. Could you please provide the proper process and required information format for case creation? For example, should we submit it via the support portal, and what details are mandatory—such as test logs, code samples, or server configuration screenshots?
We will follow your guidance to open a formal case and provide detailed reproduction steps and environment information to help clarify the issue and evaluate potential solutions.
Appendix – Minimal Test Code
VBScript (COM API) Example
Set session = CreateObject(“Notes.NotesSession”)
Call session.Initialize(“”) ’ Prompt for password
Set db = session.GetDatabase(“”, “test.nsf”)
If db.IsOpen Then
Set view = db.GetView(“vwAll”)
Set doc = view.GetFirstDocument()
Do Until doc Is Nothing
WScript.Echo doc.GetItemValue(“Subject”)(0)
Set doc = view.GetNextDocument(doc)
Loop
End If
Java Example (Notes.jar API)
import lotus.domino.*;
public class ReadAllDocs {
public static void main(String args) {
try {
Session session = NotesFactory.createSession(); // Uses local ID
Database db = session.getDatabase(“”, “test.nsf”);
View view = db.getView(“vwAll”);
Document doc = view.getFirstDocument();
while (doc != null) {
System.out.println(doc.getItemValueString(“Subject”));
Document tmp = view.getNextDocument(doc);
doc.recycle();
doc = tmp;
}
session.recycle();
} catch (Exception e) {
e.printStackTrace();
}
}
}
In both tests, the Notes ID used has only Author access to the database, yet all documents (not authored by the ID) are still retrievable.