---
title: "Security"
manual: "Laravel-style Notification System - Slack Channel"
version: "1.0"
permalink: "https://docs.typo3.org/permalink/agencelex/notifications-slack:slack-security@1.0"
source: "Security/Index.rst"
rendered: "2026-10-16T12:40:55+00:00"
---

# Security {#slack-security}

## Credentials {#credentials}

A Slack Bot Token and an Incoming Webhook URL are both credentials.
Avoid storing either in source control, notification content, or normal
application logs.

The recommended deployment pattern is:

-   Inject secrets from environment variables, a protected configuration
    file, or an external secret store.
-   Load them into TYPO3 configuration under `notifications_slack`.
-   Restrict access to TYPO3 configuration/debug tools and process environment.
-   Ensure background workers have access to the required secret values.
-   Rotate credentials immediately if they are disclosed.

> [!WARNING]
> Using `$GLOBALS['TYPO3_CONF_VARS']` is not inherently unsafe, but
> any PHP code executing in the TYPO3 process may inspect it. Restrict
> who can install extensions and access sensitive configuration dumps.

## Webhook routing {#webhook-routing}

Prefer `SlackRoute::webhookNamed('monitoring')` to a direct webhook URL.
A named route keeps the webhook URL out of the serializable route object
and resolves it from configuration during delivery.

`SlackRoute::webhook($url)` is supported but should be avoided for
asynchronous/queued notifications if queue storage is accessible to
other systems or administrators.

## HTTP and destinations {#http-and-destinations}

The transport:

-   Restricts webhook hosts to `hooks.slack.com` and
    `hooks.slack-gov.com` with HTTPS.
-   Restricts the Web API endpoint to the official Slack/GovSlack HTTPS roots.
-   Disables HTTP redirects.
-   Uses configured connection and total timeouts.
-   Suppresses raw HTTP client exception details that could reveal secrets.
-   Prevents `SlackMessage` from overriding `channel` or `token`.

## Operational security {#operational-security}

Use least-privilege permissions for the Slack application. For API
message posting, grant `chat:write` and only the additional permissions
actually required. Verify access to the destination conversation.

Protect queue storage, backups, error reporting integrations and CLI
worker process configuration. Where high-assurance isolation is needed,
consider a dedicated secret provider that avoids copying plaintext
credentials into broadly accessible configuration.

## No retry guarantee {#no-retry-guarantee}

Automatic retries are not implemented by the Slack transport. A failed
request does not necessarily prove Slack did not receive a message.
Review your Messenger retry policy, failure handling and duplicate
notification tolerance before production use.