Sensitive Data: Slack Token Leak in JavaScript Bundle¶

Identifier: js_data_leak_slack_token

Scanner(s) Support¶

Description¶

Slack OAuth tokens embedded in JavaScript bundles can let attackers invoke Slack APIs within the scopes granted to the token, including posting messages or reading workspace data. Bot and user tokens must be stored server-side, not in client-delivered scripts.

How we test: We statically analyze first-party JavaScript bundles for patterns matching Slack token prefixes (xoxb, xoxp, xoxa, and related variants).

References:

• CWE-200: Exposure of Sensitive Information to an Unauthorized Actor
• CWE-798: Use of Hard-coded Credentials
• Slack API: Token types

Configuration¶

Example¶

Example configuration:

---
security_tests:
  js_data_leak_slack_token:
    issues_count_limit: 20
    skip: false

Reference¶

issues_count_limit¶

Type : integer

The maximum number of issues to report. Use 0 to report all issues.

skip¶

Type : boolean

Skip the test if true.