Slack

Send Safeguard notifications to Slack. The scopes the bot token needs, incoming webhooks, which tokens work, and step-by-step setup.

What it does

The Slack card sends Safeguard notifications (new findings, scan results and alerts) to a Slack channel. Find the card under Integrations on the Notification tab.

This does not apply to Slack: you always connect your own workspace. A bot token can post to public and private channels the bot has been invited to; a webhook posts to the one channel it was created for.

Supported auth methods

Method (dialog label)	Use it when	Notes
Bot Token (Full Access)	You want to pick the channel from a list	A Bot User OAuth Token (`xoxb-...`) from a Slack app installed in your workspace
Incoming Webhook (Send Only)	You want the smallest possible grant	A webhook URL (`https://hooks.slack.com/services/...`) tied to one channel

Permissions required

Safeguard only posts messages and lists channels. It never reads messages, files or users through this card, and never changes channels.

Bot token

Bot token scope	Required?	What Safeguard uses it for
`chat:write`	Required	Posting notifications (`chat.postMessage`)
`channels:read`	Required	Listing public channels for Default Channel (`conversations.list`)
`groups:read`	Optional	Listing private channels the bot was invited to
`chat:write.public`	Optional	Posting to a public channel without inviting the bot first

The token is checked with auth.test, which needs no scope.

Least privilege: a Slack app of your own with chat:write and channels:read only, invited to the one notification channel.

Incoming webhook

Scope	Required?	What Safeguard uses it for
`incoming-webhook` (granted when you add the webhook)	Required	Posting notifications to that webhook's channel

Token types

Token type	Works?	Notes
Bot User OAuth Token (`xoxb-...`) with the scopes above	Yes (recommended for channel choice)
Incoming webhook URL	Yes (recommended for least privilege)	Send only; no channel list
User OAuth Token (`xoxp-...`)	No	The card expects a bot token
App-level token (`xapp-...`) or a legacy token	No

Expiry: bot tokens and webhook URLs do not expire unless your app uses token rotation, which this card does not support. Reinstall or revoke them when people leave or a token leaks.

What we never need: admin scopes, channels:history, users:read, files:write, or any user-token scope for this card.

The Install button in the dialog

The dialog's "Install the Safeguard app" button installs Safeguard's own Slack app, which asks Slack for more scopes than this card uses (other Safeguard Slack features use them). For notifications only, create your own app with the scopes above, or use an incoming webhook.

Step-by-step setup

Create the credential in Slack

Bot token:

Go to https://api.slack.com/apps, choose Create New App > From scratch, name it and pick your workspace.
Under OAuth & Permissions > Scopes > Bot Token Scopes, add chat:write and channels:read (add groups:read for private channels).
Click Install to Workspace and allow it. Copy the Bot User OAuth Token (xoxb-...).
In Slack, invite the app to the notification channel (/invite @<app name>).

Incoming webhook:

In your app's settings, select Incoming Webhooks and switch on Activate Incoming Webhooks.
Click Add New Webhook to Workspace, choose the channel and allow it.
Copy the URL under Webhook URLs for Your Workspace. Keep it secret; anyone with it can post to that channel.

Or with the CLI

Slack's CLI does not create bot tokens for an existing app. To check a token before you paste it into Safeguard:

curl -s -H "Authorization: Bearer $SLACK_BOT_TOKEN" https://slack.com/api/auth.test

Connect it in Safeguard

Open Integrations and choose the Notification tab.
Click Connect on the Slack card.
Enter an Integration Name and, optionally, a description.
Choose the Authentication Type:
- Bot Token (Full Access): paste the Bot Token; Safeguard shows "Connected to workspace:" and loads the channels; choose the Default Channel;
- Incoming Webhook (Send Only): paste the Webhook URL.
Click Connect.

Webhooks and triggers

This card only sends messages to Slack; it does not receive Slack events. Safeguard posts when the events you subscribed to happen (for example a scan finishing or a new critical finding).

What we read and store

Read: with a bot token, your workspace name and the list of channels the bot can see.
Stored: the connection's name, channel and the token or webhook URL.
Sent to Slack: notification text about your Safeguard projects and findings.
No customer data from this integration is sent to third-party LLMs.

Troubleshooting

Message you see	Cause	Fix
`Failed to validate Slack connection`	Slack rejected the token (revoked, mistyped, or the app was uninstalled)	Copy the Bot User OAuth Token again, or reinstall the app
`No channels found. Make sure the bot is invited to at least one channel.`	The bot is in no channel, or lacks `channels:read`	Invite the bot to a channel, add the scope and reinstall
`Channel discovery requires BOT_TOKEN auth type`	Channels were requested for a webhook connection	Webhooks have a fixed channel; nothing to choose
Messages do not arrive (Slack error `not_in_channel` or `missing_scope`)	The bot is not in the channel, or lacks `chat:write`	Invite the bot, or add `chat:write` (or `chat:write.public`) and reinstall

Rotation and disconnect

Rotate: reinstall the app (or create a new webhook), then open the Slack connection on the Notification tab, choose Update, paste the new token or URL and choose Save Changes.
Disconnect: choose Delete on the connection, then remove the webhook or uninstall the app in Slack (App Management, or the app's settings page).

Vendor references

chat.postMessage method, checked 2026-10-16.
conversations.list method, checked 2026-10-16.
Sending messages using incoming webhooks, checked 2026-10-16.