Scan data for secrets

Slack

5min


Slack is a messaging platform that connects people to the information they need. TruffleHog will scan public and private channels that the user has access to.

If you want to send your TruffleHog results to Slack, visit our Slack notifier page instead.

Configuration

To configure slack, you need to be able to add an app to Slack





Local configuration

Web configuration is strongly recommended for scanning Slack.

You will need to be able to create a single workspace app.

If you are able, we recommend using the Slack install from the UI because not only is it much easier, but it also scans faster because it has higher rate limits.

You may create your own single workspace Slack app to utilize with TruffleHog and provide the refresh token in the token field in the example above. Below are the steps to create the app.

1

Start creating the app here

2

Give the app a name a choose the workspace you want to TruffleHog to operate on. (You will need seperate apps to utilize a multiple workspaces)

Document image

3

Update the “User Token Scopes” section with the following scopes:

  • users:read
  • users:read.email
  • channels:history
  • channels:read
  • groups:history
  • groups:read
  • files:read
Document image

4

Make sure everything is saved and looks correct, then install your app!

Document image

5

If your account does not permissions to install the app it may send a request to your Slack admin asking for them to approve it. If so, it may be a good idea to give them a heads up before you do this :)

Document image

6

Copy your newly minted token and paste it into the token field from the local configuration file above (TIP: Remove the channels line and values if you want trufflehog to scan all accessible channels.)

Document image

Document image

7

Once you run your local scan, TruffleHog will pick up and scan the configured Slack source automatically!

Access token


Capabilities

Feature

Supported

Scan archive files

Scan attachments

Scan base64 encoded data

Scan binaries

Scan Microsoft Office files

Scan direct messages

Scan private channels (only those that authorizing user is in)

Exclude / Include filters

Real-time scanning

Auto resume



Updated 30 Jul 2024
Doc contributor
Doc contributor
Doc contributor
Doc contributor
Did this page help you?