Slack Webhook URL Committed to Source Code
What Is This Vulnerability?
A Slack incoming webhook URL is hardcoded in the source code or configuration files. While less severe than API key leaks, exposed webhook URLs allow anyone to post messages to your Slack channels, which can be used for phishing, social engineering, spam, or spreading misinformation within your organization.
Why It Happens
Slack webhook URLs are easy to set up and are often treated as non-sensitive because they only allow posting messages (not reading them). Developers embed them in notification scripts, CI/CD pipelines, or monitoring code without considering the abuse potential. The URLs are long and random-looking, giving a false sense of security.
Example Code
async function notifySlack(message: string) {
await fetch("https://hooks.slack.com/services/T0000000/B0000000/xxxxxxxxxxxxxxxxxxx", {
method: "POST",
headers: { "Content-Type": "application/json" },
body: JSON.stringify({ text: message }),
});
}async function notifySlack(message: string) {
const webhookUrl = process.env.SLACK_WEBHOOK_URL;
if (!webhookUrl) {
throw new Error("SLACK_WEBHOOK_URL environment variable is required");
}
await fetch(webhookUrl, {
method: "POST",
headers: { "Content-Type": "application/json" },
body: JSON.stringify({ text: message }),
});
}How Hackers Exploit It
An attacker with the webhook URL can post messages that appear to come from a legitimate integration. They can craft phishing messages with fake links, impersonate executives asking for sensitive information, send alarming messages to cause panic, or flood channels with spam. Because webhook messages look like trusted bot notifications, employees may not question them.
How to Fix It
Store webhook URLs in environment variables. Restrict which channels can receive webhook messages in your Slack workspace settings. Regenerate the webhook URL if it has been exposed. Consider using the Slack Web API with proper OAuth tokens instead of webhooks, as API tokens can be scoped and revoked more easily.