Phabricator Gantt

You build a phabricator gantt view by linking task dates to an external chart tool. Phabricator does not include a built-in timeline chart for project tasks out of the box. Teams usually export task data through the web API or read the backend database directly. When teams grant broad database or API roles for reporting, they create serious security risks. An overly broad role lets a reporting script read or change private project data.

How a phabricator gantt setup works in practice

Phabricator tracks work items inside its native task tracker, which teams call Maniphest. Each task holds an owner, a status, and a priority level for the team. To build a timeline, teams first add start dates and due dates to tasks. Some teams use custom fields for these dates, while others use milestone tags. Next, an external script pulls this task data on a regular schedule. The script can send requests to the Conduit API using a bot token. As an alternative, a reporting tool can query the MySQL backend database directly. Once the tool reads the task records and dependency links, it draws the chart. Project leads then read this chart to spot blocked tasks and late milestones.

Permissions play a major part in how this data pipeline runs every day. Inside the main app, space rules and project policies decide who can view tasks. If your chart tool uses an admin API key, it bypasses user view rules. Anyone who views the external chart might see private security bugs or restricted tasks. The risk grows worse when teams connect reporting tools straight to the MySQL database. A shared database user often has read access to every table in the system. That includes tables with user emails, phone numbers, and secret repo keys.

What native roles solve and what they leave open

Native roles in Phabricator handle basic login checks and project view rules very well. You can group users by team and lock down specific task boards with ease. You can also create bot accounts with dedicated tokens for your reporting apps. At the database level, MySQL roles let you grant read-only access to specific schemas. These controls decide who can log in and start a session with the server.

Still, native setup controls stop working once a session starts running. A MySQL role cannot inspect individual queries in flight to block sensitive columns. If a chart script queries the user table, the database returns raw emails and phone numbers. Native controls also fail to link shared bot queries back to an individual person. When an engineer runs a manual fix on the task database, the log shows a shared role. You cannot require peer approval for a single risky update statement using native roles alone. Data masking is also missing, so sensitive fields never get rewritten in query results.

Managing task data queries and API scripts safely

To keep project data safe, teams should limit what reporting scripts can read. Start by creating a dedicated read-only database user that only reads task tables. Never give your chart tool access to user credential tables or code tables. When you use the API, place the bot account in public project spaces only. This step stops the bot from pulling restricted tasks into a shared timeline view.

Teams also need clear visibility into every query that touches the backend database. Engineers often connect to the database to fix broken task links or bulk dates. Instead of sharing a root password, each engineer should log in with their own identity. Every query and command should go into a central log for later review. Masking rules should rewrite emails, phone numbers, and card numbers in query results by default. This setup lets engineers fix timeline bugs while keeping personal data safe from leaks.

Govern statements and responses across databases and APIs

Good config and scoped roles are needed setup. They do not check single queries in flight or mask sensitive fields in returned rows. Across Postgres, MySQL, SQL Server, MongoDB, ClickHouse, Kubernetes APIs, SSH, and internal HTTP endpoints, hoop.dev runs beside each supported service as an open-source proxy, a sidecar for your database or API.

First, hoop.dev guardrails block banned queries before they run. Then hoop.dev data masking rewrites matched sensitive values in responses in memory. The audit trail records every statement and verdict per resource. Furthermore, hoop.dev holds SOC 2 Type II and is open source on GitHub.

Frequently asked questions

Does Phabricator have a native Gantt chart feature?

No, the core platform focuses on workboards, task lists, and burnup charts instead. Teams build timeline views by connecting third-party chart tools to the API or database.

Should our chart tool use the API or direct database reads?

The API is safer for small teams because it respects basic app view policies. Direct database reads run faster for large task sets, but they require strict query controls.

How can we stop timeline scripts from leaking private data?

Restrict the database user to specific task tables and avoid using admin API tokens. You can also apply masking rules that rewrite sensitive fields like emails in query results.

Related guides

• Best Practices for Data Risk Frameworks
• Best Practice User Group
• Best Practices Infrastructure As Code Network Management