# Zoombombing Security Bug! **URL:** \ **Category:** Feature Requests\ **Created:** [May 18, 2020, 9:13am UTC](https://devforum.zoom.us/t/zoombombing-security-bug/18107 "2020-05-18T09:13:34Z")\ **Posts on this page:** 5\ **Page:** 1
**Author:** ![jude.niroshan11](https://sea2.discourse-cdn.com/flex016/user_avatar/devforum.zoom.us/jude.niroshan11/32/6632_2.png) [@jude.niroshan11](https://devforum.zoom.us/u/jude.niroshan11)\ **Post date:** [May 18, 2020, 9:13am UTC](https://devforum.zoom.us/t/zoombombing-security-bug/18107/1 "2020-05-18T09:13:34Z")
# Abstract I want to protect my zoom meeting by disabling invite button for attendees. ## My Story: I have a web application which has a Web SDK embedded. I am using `disableInvite` option in Web SDK.✅ It works as I want and no problem with that except Web SDK is not suitable for mobile users. Therefore I have to use URL schemes to allow the mobile users to redirect to their zoom app which installed in their mobile device to join to my meeting. Upto this point everything was like a paradise. I have purchased large meeting add-on and I have the limitation for number of attendees who can join my meeting. So I pay to zoom for all the attendees who are joining to my zoom meeting. ## Problem: Any attendee can simply invite their dog or cat who has a zoom account. How fair is that? I have bought 500/1000 attendee package to have the control of my meeting as a host. But zoom **DOES NOT provide me any option** to disable the invite button for attendees. 😥 😥 😥 This is a MAJOR BUG! ⚠ People have discussed this security hole [here](https://devforum.zoom.us/t/meeting-password-and-invitation-url-on-zoom-client/11100/13), [here](https://devforum.zoom.us/t/i-want-to-hide-or-disable-invite-button-for-participants-window-in-zoom-meeting-api/4580) and [here](https://devforum.zoom.us/t/stop-attendees-to-invite-others-in-meeting/6883). ## Suggestions by zoom so far I have spent days to find out a way to achieve my requirement. Zoom Web SDK provide a option to hide the ‘invite’ button. Yey! This is what I wanted. But [zoom URL schemes](https://marketplace.zoom.us/docs/guides/guides/client-url-schemes) do not have option on this. So all my mobile user attendees can RUIN my meeting. _Lock meeting_ option is nice but it is not the solution to my problem. Because what if one of my attendee lost their internet connection and wants to join back to the meeting? It is a complete distraction to the meeting host. (My meeting has around 900 participants.) _Enable waiting room_ is also nice but this is completely a different feature. As I told I have 900 participants and host cannot accept all 900 participants mannually. [I know there will be an up coming new feature](https://marketplace.zoom.us/docs/guides/stay-up-to-date/upcoming-changes/api) called **auto\_admit\_participants\_with\_specified\_domains**. This will not help me. 🚩 Because the attendees can have any email address. `abc@gmail.com`, `xyz@yahoo.com` etc ## Summary Dear zoom + @tommy @carson.zoom @michael_p.zoom I am asking one thing. 1️⃣ **Just allow me a way to hide the ‘invite’ option within my meeting.** 🙏 I have already created a feature request. Guys please vote this thread and let the Zoom to understand the priority of this request. Thanks. 🕊 ---
**Author:** ![javierangelesmar](https://sea2.discourse-cdn.com/flex016/user_avatar/devforum.zoom.us/javierangelesmar/32/7672_2.png) [@javierangelesmar](https://devforum.zoom.us/u/javierangelesmar)\ **Post date:** [May 22, 2020, 2:37am UTC](https://devforum.zoom.us/t/zoombombing-security-bug/18107/2 "2020-05-22T02:37:24Z")
I’m facing exactly the same issue. Would be very nice to have able/disable switch for that. ---
**Author:** ![nightpool](https://sea2.discourse-cdn.com/flex016/user_avatar/devforum.zoom.us/nightpool/32/5676_2.png) [@nightpool](https://devforum.zoom.us/u/nightpool)\ **Post date:** [May 26, 2020, 8:40pm UTC](https://devforum.zoom.us/t/zoombombing-security-bug/18107/3 "2020-05-26T20:40:26Z")
From your description of your usecase, it sounds like what you really want is a webinar. Webinars offer more control over the participants of a meeting, including disabling the invite function, as well as a bunch of other useful features for 900 person meetings (it would be just as much of a shame if someone started screen-sharing or yelling during your meeting, right?) ---
**Author:** ![michael\_p.zoom](https://sea2.discourse-cdn.com/flex016/user_avatar/devforum.zoom.us/michael_p.zoom/32/18105_2.png) [@michael\_p.zoom](https://devforum.zoom.us/u/michael_p.zoom)\ **Post date:** [June 1, 2020, 5:21am UTC](https://devforum.zoom.us/t/zoombombing-security-bug/18107/4 "2020-06-01T05:21:58Z")
Hi @jude.niroshan11 With the latest version of the WebSDK 1.7.8 you can hide the meeting information inviteUrl link using ZoomMtg.init -\> inviteUrlFormat API[1] - [https://zoom.github.io/sample-app-web/ZoomMtg.html#init](https://zoom.github.io/sample-app-web/ZoomMtg.html#init). In terms of preventing “Zoombombing”… 1. Waiting Room - When having meetings of over 100+ or even 900 in this case, it’s best to have a co-host to help manage current participants & admit attendees in the waiting room without interrupting the meeting. 2. Meeting Registration - You can add registration to meetings thus every intended participant will have their own unique join\_url link. Let us know if this helps. Thanks ---
**Author:** ![DeveloperBot](https://sea2.discourse-cdn.com/flex016/user_avatar/devforum.zoom.us/developerbot/32/12632_2.png) [@DeveloperBot](https://devforum.zoom.us/u/DeveloperBot)\ **Post date:** [August 21, 2020, 9:38pm UTC](https://devforum.zoom.us/t/zoombombing-security-bug/18107/5 "2020-08-21T21:38:20Z")
Closed on August 21, 2020, 9:38pm UTC