Slack MCP Server

# Security Policy

## Reporting a Vulnerability

If you discover a security vulnerability, please report it responsibly:

1. **Do NOT** open a public GitHub issue
2. Email the maintainer directly or use [GitHub's private vulnerability reporting](https://docs.github.com/en/code-security/security-advisories/guidance-on-reporting-and-writing-information-about-vulnerabilities/privately-reporting-a-security-vulnerability)
3. Include a description of the vulnerability, steps to reproduce, and potential impact

We will acknowledge receipt within 48 hours and provide a fix timeline.

## Security Considerations

### Token Handling

- **Never commit** Slack tokens (`xoxb-...`, `xoxp-...`) to version control
- Use environment variables or `.env` files (already in `.gitignore`)
- Rotate tokens immediately if accidentally exposed

### Write Operations

Write tools (send/update messages, upload files, add reactions, etc.) are **disabled by default**. Enable only when necessary:

```bash
SLACK_MCP_ENABLE_WRITE=true
```

### Channel Restrictions

Use the channel whitelist to limit which channels the bot can send messages to:

```bash
SLACK_MCP_ALLOWED_CHANNELS=C123,C456
```

### Principle of Least Privilege

When creating your Slack app, grant only the OAuth scopes needed for your use case. See the [README](README.md) for the full scope list.

## Supported Versions

| Version | Supported |
|---------|-----------|
| 0.1.x   | Yes       |