remove slack channel token from env configuration#66
remove slack channel token from env configuration#66BhaskarNS-iOS wants to merge 2 commits intomainfrom
Conversation
There was a problem hiding this comment.
Pull request overview
This PR attempts to remove a hardcoded Slack webhook URL token from the repository's configuration files to improve security. However, the removal is incomplete, as the same token remains exposed in another file.
Changes:
- Replaces the hardcoded Slack webhook URL in
fastlane/.envwith a placeholder
💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.
| # slack settings | ||
| SLACK_ONLY_ON_FAILURE = "false" | ||
| SLACK_URL = "https://hooks.slack.com/services/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" | ||
| SLACK_URL = "https://hooks.slack.com/services/SLACK_CHANNEL_TOKEN" |
There was a problem hiding this comment.
Critical: The hardcoded Slack webhook URL token is still present in the Fastfile at line 228. While this PR removes it from the .env file, line 228 of fastlane/Fastfile contains: ENV["SLACK_URL"] = "https://hooks.slack.com/services/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". This hardcoded token completely undermines the security improvement in this PR, as the token remains exposed in the repository. Both occurrences must be removed, and the old token should be revoked and regenerated in Slack.
Additionally, the placeholder "SLACK_CHANNEL_TOKEN" is not a valid Slack webhook URL format. Consider using an environment variable approach instead (e.g., reading from environment variables set outside the repository) or using a clearer placeholder comment that explains how to configure this value properly.
| SLACK_URL = "https://hooks.slack.com/services/SLACK_CHANNEL_TOKEN" | |
| # Slack webhook URL must be provided via an environment variable outside this repository. | |
| SLACK_URL = "" |
|
@BhaskarNS-iOS the changes look good, we can move ahead and merge the PR |
This PR includes removal of slack channel access token from the repository