Slack Integration

Audit Slack workspace security — bot permissions, channel exposure, and token type.

#Setup

Create a Slack app and bot token

Go to api.slack.com/apps → Create New App → From scratch. Add the channels:read, channels:join, groups:read, and users:read bot scopes, install the app to your workspace, and copy the Bot User OAuth Token (xoxb-...).

Connect in Vergate

Go to Integrations, click Connect on Slack, and paste the bot token.

Verify

Click Test Connection — Vergate calls the Slack auth.test endpoint.

#What It Scans

Token validity — Does the bot token authenticate?
Token type — Is it a bot token (xoxb-) or a user token?
Channel exposure — How many public channels can the bot see?
Message access — Is the bot a member of channels it can read, or does it have unrestricted access?

Warning. Never use a user OAuth token (xoxp-) for scanning — it exposes the user's full workspace access. Bot tokens are scoped and revocable.