EngineeringScoreExposure Medium
Revoke the exposed Slack token
A Slack token lets whoever holds it act as the app or user it was issued for: reading and posting messages in every channel it can reach, and depending on scope, pulling files and message history. A token shipped to the browser hands that same access to anyone who loads the page.
Why it matters
A Slack token can read and post messages in every channel it can reach, letting an attacker read private conversations or impersonate a workspace member.
How to fix
- 1 Revoke the token from the Slack app's configuration (or reinstall the app to rotate it). This is the only step that stops it from working.
- 2 Move any use of the token to a server-side environment; never ship a Slack token to the browser.
- 3 Purge it from git history so it is not recoverable from a prior commit.
- 4 Redeploy and confirm the new build no longer ships the token.
Common mistakes
- Rotating the app's token but leaving an older installation or workspace integration that still references the previous value active.
- Granting the app broader channel or workspace access than the feature actually needs, which increases what a leaked token can read.
- Removing the token from the current build without purging it from git history, leaving it retrievable from any prior commit.
How to verify
- 1 Re-run the scan and confirm the Slack token finding is gone.
- 2 Grep the built/deployed JavaScript bundle for the xoxb-/xoxp- prefix to confirm no token remains.
- 3 Confirm the old token now fails Slack API calls rather than assuming rotation took effect.
Related checks
Ready to see where you stand?
Scan your site and get your Engineering Score with a prioritized roadmap in under a minute, no signup required.