Slack security: secrets pasted into chat

An engineer needs an API token to finish a deployment. A colleague copies it from the password manager and pastes it into a direct message. The deployment works, and the token stays in that conversation, searchable by anyone who later gets into either account.

Six months later, an attacker signs in to the colleague’s account with a stolen password. Searching their messages for “token” takes a few seconds.

Chat is where work happens now, so it’s also where credentials, customer details and card numbers end up. This post covers how to find them and what to do next. It sits beside security operations, which covers the alerts, phishing reports and compromised accounts that can follow.

What does Slack security cover?

Slack security covers who can join your workspace and channels, which apps can read messages, and what gets shared in them. The part teams most often miss is the content: secrets and personal data pasted into channels and direct messages, where they stay searchable long after anyone needs them.

What gets pasted, and why it stays

1. Credentials and API tokens. Colleagues share them to save a trip to the password manager.
2. Personal data. Home addresses, ID numbers and health details get shared with HR or a manager.
3. Card numbers. Someone sends the company card to a colleague to finish a purchase.
4. Customer records. Data is pasted from the CRM into a channel shared with an outside partner.
5. Nobody goes back. Messages are kept by default, so a secret shared once stays in search for years.

What it costs

Anyone who gets into one account can search it for passwords and tokens, and search makes that fast. Personal data in chat creates privacy obligations nobody is tracking. Customer data in a shared channel has already left the company.

What to fix first

1. Scan new messages for secrets and personal data. Match known token formats, card numbers and ID numbers as messages arrive.
2. Tell the sender straight away. A private message explains what was found and asks them to delete it.
3. Rotate any credential that was exposed. A token pasted into chat needs replacing, even after the message is deleted.
4. Alert security for the serious cases. Customer data in a shared channel, or a production credential, opens a case.
5. Set retention for direct messages. Shorter retention limits how much an attacker can search.

The Slack keyword alert template is a starting workflow for the scan and the message to the sender.

Where it fits

A credential found in chat is a likely route to account takeover, so rotate it before anyone tries it. Message and app activity also belong in the SIEM, which SIEM logging covers.

For every part of security operations, from first alert to shipped fix, see SOC automation.