Slack App Security: Securing Your Workspaces From a Bot Uprising
summary
Slack checks that requested OAuth scopes are actually used and runs apps in test workspaces, but it lacks source code visibility and most apps sit atop larger web services the team cannot audit. Automated scans use in‑house tooling (wrapping tools like sqlmap) and QA uses Burp Suite; a subset of high‑scope apps get third‑party pen tests. About 94% of Slack workspaces use apps, the product security team is small — five product security engineers — so proposals include paid pen tests, certs, hosting apps, vendor reviews, bug bounties, and surfacing pentest dates/privacy info per app.
AI-written summary · about
chapters (23)
- 0:00Intro
- 0:52Welcome
- 3:07What is Slack
- 5:41App Directory
- 6:45App Quality
- 7:52App Directory Comparison
- 9:53What Makes Slack Different
- 11:15Risk Ownership
- 12:35Security Implications
- 13:03Deep Breath
- 13:16Current Test Process
- 14:18Manual Testing
- 14:40Why isnt this enough
- 16:23What can we do
- 17:26Pentesting
- 18:34Certifications
- 19:59Hosting Services
- 20:20Compliance Vendor Review
- 20:41Bug Money
- 21:26Combined Risk Score
- 22:55Aggregate Risk Score
- 24:36Conclusion
- 25:33Questions
