Slack

What it does

• Posts findings alerts and notifications to the channel your incoming webhook was created for.
• Sends messages from your own automation through the Slack endpoints.
• Gives AI engineers a channel for updates and conversations with your team.

Requirements

• A Slack workspace where you can install apps, or permission to create an incoming webhook.
• The integrations:slack:manage member scope to connect, and integrations:notify to send messages.

Connect

In Settings, Integrations, choose Slack and either:

1. Connect with OAuth. Approve the BreachLine app in Slack and pick the channel for alerts. For alerts and notifications the app asks for chat:write, chat:write.public and incoming-webhook; the Slack connection your AI engineers use for conversations asks for chat:write, channels:read and channels:history.
2. Use an incoming webhook. Paste a webhook URL. It is stored encrypted and is write-only.

Permissions and data handling

• The bot token or webhook URL is never returned; GET /api/v1/integrations/config reports only has_webhook, has_bot_token, the method and the default channel.
• Messages contain what you or Nebula send: finding titles, severities and summaries. Do not include secrets in findings you send to shared channels.

Troubleshooting

Symptom	Check
Messages do not arrive	Slack is still connected (the endpoints return 409 when it is not), and the webhook has not been revoked in Slack.
403 from the notify endpoints	The calling member has integrations:notify.
Wrong channel	Alerts always go to the channel chosen when Slack was connected (the incoming webhook’s channel); the channel field is ignored. Reconnect Slack and pick the channel you want, or paste a webhook created for it.

Known limitations

• Channel history is read only for channels the app can see.
• Disconnecting removes the stored token; reconnect to resume.