[Product Launch] Introducing the Command Palette: perform lightning-fast search and app actions

You asked for ways to quickly navigate Retool to your queries, components, apps, and more.
We’re excited to officially launch the Command Palette, a powerful tool for quickly running 90+ commands and finding everything you need within Retool—without leaving your keyboard!

command-palette-twitter-final-export

Instead of searching and clicking around the editor to perform common actions, you can access the properties, settings, and commands you use most with Command Palette. You can navigate your entire workspace by searching for components and queries within the app editor or jump to other apps, shared queries, and resources across your organization.

Access the Command Palette with the Cmd+K (Mac) or Ctrl+K (Windows) keyboard shortcuts, or click on the search icon in the top right corner of the editor.

Check out our launch blog post to learn more: Introducing Command Palette: perform lightning-fast search and app actions

And learn how and why we built it in our design blog post: Designing Retool's Command Palette

Doc: https://docs.retool.com/docs/command-palette

1 Like

This command palette appears to let end users access information on resources that they shouldn't be able to.

It is a major security issue, as passwords and url links are visible to the end users.

Is there a way to disable end users being able to access the command palette?

Hello @bg1900 ,

Sending you a DM - I'd like to follow up on what you have raised.

Thank you,
Brett

1 Like

Hello,

Still waiting for a response to the issues raised…

Hi, is it possible to turn off the command pallet on apps?

Hi @wizzard,

No, we don't have a feature for disabling the command pallete on apps. Would you mind expanding on your use case? Do you have any feedback or concerns with the command pallete?

I echo what bg1900 stated above.

This enables end-users access information on resources that they shouldn't be able to and can be a major security flaw in the design of this feature.

Hi @wizzard,

When this was first brought up, our security team reviewed it and didn't find cases where the command palette feature exposed passwords or concerning urls that would otherwise not be seen by end users.

Could you please share a screenshot or example of a network response that's concerning? Feel free to send to me via DM. I will have our security team take a look!

We do have a related request in our queue to not show app names in the Command Palette to users if they do not have permission to use those apps, but the command palette still respects permissions in that the users cannot actually access the apps they don't have permission on. I can post here when that request is shipped