What you hand over when you forward a meeting invite
The whole attendee list, the organiser, the dial-in number and its PIN, and a link that is often enough on its own to walk into the meeting.
Everything that was in it. Forwarding a meeting invitation passes on every attendee — names and email addresses, including the ones from outside your organisation — the organiser, the conference number and its PIN, and the join link. Search for this and you will be told how to click Forward in Outlook, which is not what anybody asking is worried about. The reason the leak is so reliable is that an .ics file is plain text that nobody ever opens. CALSCRUB opens it in your browser, lists what is in it, and lets you take out the parts you did not mean to send while leaving an invitation that still works.
What is actually in the file
An invitation is a short text file. Each line is a field, and the interesting ones are these:
| Field | What it hands over |
|---|---|
ATTENDEE | One line per person: display name, email address, their role, and whether they have accepted. Group addresses like finance@ appear here too, as does anybody from another company |
ORGANIZER | Who called the meeting, with their address |
DESCRIPTION | The body of the invitation, which is where the dial-in number and the conference PIN live — not in a field of their own, which is why they are so easy to forget |
LOCATION | A room, an address, or the name of the meeting platform |
SUMMARY | The title, which on a legal or commercial matter is frequently the most sensitive line in the file |
UID, SEQUENCE | The meeting's identity and how many times it has been changed |
PRODID, X- lines | The software that wrote it and its version, plus platform-specific extras such as a second copy of the join URL |
Long lines are folded across several physical lines with a leading space, which is why an address can look absent when you skim the file and is present all the same.
The join link is closer to a key than to an address
Treat the join URL as a credential rather than as a location. Depending on how the meeting is configured — whether there is a lobby, whether it is restricted to your organisation, whether guests are admitted automatically — possession of the link can be the whole of what is needed to be in the room. The dial-in number with its PIN is the same thing in a different format, and a PIN sitting in the middle of a paragraph of text is not something anybody redacts by eye.
This matters most in the case people actually do: forwarding an invitation to bring one extra person in. You meant to send a time. You sent a time, a guest list and a way in.
Hiding the attendees does not un-send anything
Most platforms can hide the attendee list, and it is worth turning on. It is not a remedy after the fact. The setting governs what is written into invitations going out from now on; anybody who already holds a copy of the invitation holds the copy they were sent, with the list in it. A file that has left your machine is not covered by a setting on your machine.
Which is the general shape of the thing: the only reliable control over what an invitation contains is what you put in the file before you send it.
The larger leak is the export, not the forward
Forwarding one invitation exposes one meeting. Exporting a calendar — to move between accounts, to back it up, to attach to a support ticket — produces a single file containing every meeting you have had.
A year of invitations is not a list of appointments. It is a map: who an organisation talks to, how often, when the board meets, which clients exist, which deals were live in which weeks, and which people were in the room for each. Nobody would send that deliberately, and it goes out as one attachment.
Sending one without all of it
Open the file in CALSCRUB. It lists what it found — each attendee, the organiser, the numbers and PINs it located inside the description, the join links, the identifiers — and you tick what to remove. What comes out keeps the time, the title and the structure, so it is still a working invitation rather than a broken one.
What to remove is a judgement rather than a fixed list, which is why the tool asks instead of deciding. Sending a colleague a meeting without the dial-in details is useless to them. Sending a supplier one with your entire client-side attendee list is careless. The file runs in the page; nothing is uploaded.
What this is and is not
CALSCRUB reads and rewrites an .ics file in your browser. For a document rather than a calendar, SCRUB handles Office files, and X-RAY will list what is inside almost anything.
None of this changes what the meeting platform itself knows, or what your employer's mail server keeps. It is about the file you are about to forward, which is the part you control and the part that gets forgotten.
Questions people ask about What you hand over when you forward a meeting invite
Does forwarding a meeting invite show everyone's email address?
Yes. Every ATTENDEE line goes with it — display name, email address, role and whether they have accepted — along with the organiser, the conference number and PIN, and the join link. Search for this and you will be told how to click Forward, which is not what anybody asking is worried about.
What is actually in an .ics file?
Plain text, one field per line. ATTENDEE for each person, ORGANIZER for whoever called it, SUMMARY for the title, LOCATION, and DESCRIPTION for the body — which is where the dial-in number and the PIN sit, rather than in fields of their own. Plus UID and SEQUENCE, and PRODID naming the software that wrote it.
Why do addresses sometimes look like they are not there?
Because long lines are folded. A line past about seventy-five characters continues on the next one with a single leading space, so an address can be split across two lines and look absent when you skim the file. It is present, and anything reading the file properly will reassemble it.
How bad is it to pass on the join link?
Treat it as a credential rather than a location. Depending on how the meeting is set up — whether there is a lobby, whether it is restricted to your organisation, whether guests are admitted automatically — holding the link can be the whole of what is needed to be in the room. The dial-in number with its PIN is the same thing in another format.
Does hiding the attendee list fix it?
Going forward, yes, and it is worth turning on. After the fact, no. The setting governs invitations written from now on; anybody who already holds a copy holds the one they were sent, with the list in it. A file that has left your machine is not covered by a setting on your machine.
What is the worst version of this?
Exporting a calendar rather than forwarding one invitation — to move accounts, to back it up, to attach to a support ticket. That produces one file containing every meeting you have had, and a year of invitations is a map of who an organisation talks to, when the board meets, which clients exist and which deals were live in which weeks.
Can I forward one without all of that?
Yes. Open it in CALSCRUB, which lists each attendee, the organiser, the numbers and PINs it finds inside the description, the join links and the identifiers, and lets you tick what to remove. What comes out keeps the time, the title and the structure, so it still works as an invitation.
What should I take out?
It depends, which is why the tool asks rather than deciding. Sending a colleague a meeting without the dial-in details is useless to them; sending a supplier one with your whole client-side attendee list is careless. The file is read and rewritten in the page and nothing is uploaded.