Slack (Secrets Scanning)

Scan Slack channels and messages for exposed secrets

The Slack (Secrets Scanning) Integration in the Praetorian Guard Platform (PGP)

The Slack (Secrets Scanning) integration in PGP provides continuous scanning of your organization's Slack workspace to detect exposed secrets such as API keys, tokens, passwords, and other sensitive information. PGP connects to Slack using a bot token, discovers the channels the bot can access, and scans their messages — including threaded replies — for security risks. On subsequent scans, PGP performs incremental checks — only re-scanning content posted since the last run.

Note: This is the secret-scanning Slack integration. It is separate from the Slack integration used for alert/notification delivery — connecting one does not affect the other.

Prerequisites

Before you begin, ensure you have:

  • A Slack workspace
  • Permission to create and install a Slack app in that workspace (workspace owner or admin)
  • Access to your PGP account

Creating a Bot Token in Slack

  1. Go to Slack API: Your Apps and click Create New App → From scratch
  2. Name the app (e.g., "PGP Integration") and select your workspace
  3. Under OAuth & Permissions, add the following Bot Token Scopes:
    • channels:read and channels:history (public channels)
    • groups:read and groups:history (private channels)
    • (Optional) im:read/im:history and mpim:read/mpim:history — include direct messages and group DMs the bot participates in; without these scopes, DMs are skipped
  4. Click Install to Workspace and authorize the app
  5. Copy the Bot User OAuth Token — it begins with xoxb-
  6. Invite the bot to every channel you want scanned — public and private (/invite @PGP Integration)

Note: Slack only allows a bot to read message history in channels it is a member of — this applies to public channels as well as private ones. Public channels the bot has not joined are still discovered as assets, but their scans will fail until the bot is invited.

Configuring the Integration in PGP

  1. In PGP, navigate to the Integrations page
  2. Find and click on Slack (Secrets Scanning) under the "SaaS Security" section
  3. Provide the following details:
    • Workspace — Your Slack workspace name or team ID
    • Access Token — The Bot User OAuth Token you created (xoxb-…)
  4. Click Connect to establish the integration

Once configured, PGP will discover the accessible channels and scan their messages for exposed secrets.

Verifying the Connection

To verify that your connection is working:

  1. Navigate to Assets in PGP
  2. Look for slack:channel assets — each discovered channel appears as an asset named after the channel
  3. Check the Integrations page to confirm the Slack connection status

Remediating Exposed Secrets

To fully eliminate an exposure surfaced in Slack:

  1. Delete the message (and any threaded replies) containing the secret
  2. Rotate the affected credential to invalidate any copies that may have already been captured

Because messages are visible to every member of the channel — and may have been copied, quoted, or exported — treat any surfaced secret as compromised until it has been rotated.

Troubleshooting

Common issues and solutions:

  • Unable to Connect — Verify the token is a bot token beginning with xoxb- and the app is installed in the workspace
  • Missing Scope Errors — Add the required Bot Token Scopes listed above and reinstall the app
  • Workspace Mismatch — Ensure the Workspace value matches the workspace name or team ID the token belongs to
  • No Channels Discovered — Public channels are discovered automatically with channels:read; private channels are only listed if the bot is a member, so confirm the bot has been invited
  • Channel Scans Failing (not_in_channel) — The bot must be a member of a channel — public or private — to read its history. Invite the bot to the channel and the next scan will succeed

If you continue to experience issues, contact PGP Support.

Managing Your Connection

To manage your Slack connection:

  1. In PGP, navigate to the Integrations page
  2. Find your Slack (Secrets Scanning) connection
  3. Use the options menu (⋮) to update the stored credential (Refresh Token) or remove the connection (Disconnect)

Additional Resources

Need help? Contact our support team for assistance.