Skip to content

remove slack channel token from env configuration #66

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
BhaskarNS-iOS wants to merge 2 commits into
base: main
Choose a base branch
from
Open

remove slack channel token from env configuration #66

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
2 commits
Select commit Hold shift + click to select a range
8410e05
remove slack channel token from env configuration
BhaskarNS-iOS Feb 16, 2026
53a378e
remove slack channel token from Fastfile configuration
BhaskarNS-iOS Feb 16, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
2 changes: 1 addition & 1 deletion fastlane/.env
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -10,4 +10,4 @@ BADGE_ICONFILES = "/OSCA/Assets.xcassets/AppIcon.appiconset/*icon*.png"

# slack settings
SLACK_ONLY_ON_FAILURE = "false"
SLACK_URL = "https://hooks.slack.com/services/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"
SLACK_URL = "https://hooks.slack.com/services/SLACK_CHANNEL_TOKEN"
Copy link

Copilot AI Feb 16, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Critical: The hardcoded Slack webhook URL token is still present in the Fastfile at line 228. While this PR removes it from the .env file, line 228 of fastlane/Fastfile contains: ENV["SLACK_URL"] = "https://hooks.slack.com/services/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". This hardcoded token completely undermines the security improvement in this PR, as the token remains exposed in the repository. Both occurrences must be removed, and the old token should be revoked and regenerated in Slack.

Additionally, the placeholder "SLACK_CHANNEL_TOKEN" is not a valid Slack webhook URL format. Consider using an environment variable approach instead (e.g., reading from environment variables set outside the repository) or using a clearer placeholder comment that explains how to configure this value properly.

Suggested change
SLACK_URL = "https://hooks.slack.com/services/SLACK_CHANNEL_TOKEN"
# Slack webhook URL must be provided via an environment variable outside this repository.
SLACK_URL = ""

Copilot uses AI. Check for mistakes.
2 changes: 1 addition & 1 deletion fastlane/Fastfile
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -225,7 +225,7 @@ puts ENV["SLACK_URL"]
# Send a slack notification on success
unless (ENV["SLACK_ONLY_ON_FAILURE"] == "true") then

ENV["SLACK_URL"] = "https://hooks.slack.com/services/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"
ENV["SLACK_URL"] = "https://hooks.slack.com/services/SLACK_CHANNEL_TOKEN"

app_version = git_tag_prefix + "/" + new_build_number.to_s
slack_payload = [:last_git_commit, :last_git_commit_hash, :git_author]
Expand Down
Loading