Slack API-token pattern appears in public content
ShipReady found a non-placeholder string matching a supported Slack API-token pattern in scanned page or script content.
Why it matters
A real Slack API token should not be included in browser-delivered code or content that visitors can inspect.
How ShipReady detects it
What it inspects
ShipReady scans fetched page content and discovered script content for supported Slack xoxb-, xoxp-, xoxa-, xoxr-, and xoxs- token patterns, with a placeholder guard.
What triggers a finding
The rule triggers when a non-placeholder string matches one of ShipReady's supported Slack API-token patterns.
What the evidence shows
The scanner observed a string matching a supported Slack token format and records only a redacted prefix.
Limits of this check
ShipReady does not authenticate to Slack, validate the token, inspect scopes, read channels, download files, or post a message. The format match does not prove that the token is active, usable, or authorized for any workspace action.
How to fix it
Locate the public token-shaped value
Trace the matched asset to its source and build configuration.
Keep real tokens out of client code
Remove confirmed Slack tokens from browser bundles and store them only in trusted server-side secret configuration.
Review a confirmed token
If the value is confirmed as real, use the workspace owner's controls to review and replace it.
How to verify the change
Inspect deployed public assets
Search deployed HTML and JavaScript after remediation.
Expected: No unintended string matching a supported Slack API-token pattern remains in public content.