| name | security-review |
| description | Review code for security issues in self-hosted and managed Vercel deployments of this Slack bot. Covers secrets, tokens, permissions, logs, user data handling, SSRF, and data minimization. Use when reviewing code for security, auditing data handling, checking for leaked secrets, or verifying privacy compliance. |
Security Review
Review the relevant code with a code review mindset. Prioritize bugs, behavioral regressions, security issues, and missing tests. Findings must be the primary focus, ordered by severity. Do not make code changes unless the user explicitly asks for them.
This is a self-hostable Slack bot. Review it for security issues in both self-hosted deployments and our managed Vercel deployment. Pay close attention to how secrets, tokens, permissions, logs, and user data are handled. Make sure we do not collect, track, or store any user data unless it comes from the Million workspace or is strictly required for the product to function.
Threat Model
Two deployment modes — each has different trust boundaries:
| Mode | Operator | Tokens held by | Trust boundary |
|---|
| Managed (Vercel) | Million | Million | Million workspace data only; no cross-workspace leaks |
| Self-hosted | External operator | Operator | Operator controls their own data; bot must not phone home |
Review Checklist
Work through every item. Report each finding with severity, file, and line range.
Secrets & Credentials
Token & Session Handling
SSRF & URL Validation
Data Minimization & Privacy
Permissions & Authorization
Error Handling & Logging
Dependency & Deployment Surface
Severity Scale
| Level | Meaning |
|---|
| P0 — Critical | Exploitable now: RCE, auth bypass, secret leak to client |
| P1 — High | Data exposure, privilege escalation, SSRF |
| P2 — Medium | Missing validation, excessive logging, weak error handling |
| P3 — Low | Hardening opportunities, defense-in-depth gaps |
Output Format
### P0 — [Title]
**File:** `path/to/file.ts` (lines X–Y)
**Issue:** Description of the vulnerability
**Impact:** What an attacker can achieve
**Fix:** Concrete remediation steps
Group findings by severity. End with a summary count: X critical, Y high, Z medium, W low.
