Onboarding Without an Office
Slack's Product Security Foundations (PSF) team hosted two interns this past summer, but neither of them ever set foot in a Slack office. What would normally have meant relocating to a new city and commuting to an unfamiliar building became a matter of clicking "Join Meeting" from home. The first week followed the usual arc—machine setup, learning the codebase language, project introductions—but all of it happened over Slack and Zoom. Working inside the very platform we were building on turned out to be a useful onboarding exercise in itself, teaching both proper Slack etiquette and the product's deeper functionality.
The distributed format didn't slow down the social side of onboarding. Between scheduled intern hangouts and impromptu video calls, the two newcomers found it easy to connect with their cohort. Maintaining a Slack-linked calendar with meeting notifications helped manage what initially looked like an intimidating schedule.
Building Team Connections Remotely
Before the second intern's start date, both joined a video call with their mentors and Suzanna Khatchatrian, senior manager of PSF. Their first days included one-on-ones with her to review detailed onboarding documents covering the company, the team, intern roles, and summer expectations. Those documents became a reference point throughout the internship. A virtual welcome lunch introduced the full team—conversations ranged from current projects to the correct La Croix flavor. Even without face-to-face contact, relationships developed through coffee chats, online games, and daily standups.
Setting up one-on-ones with the broader team early on paid off, as did regular non-work social hours over Zoom. A "not-so-secret" recurring intern meeting also helped maintain a peer connection throughout the summer.
Tackling an XSS Problem
PSF's project focused on cross-site scripting (XSS) prevention. XSS happens when an attacker injects malicious code into HTML or CSS, potentially executing scripts in other users' browsers. On Slack, that risk appears during URL unfurling: a user-shared link could include an attacker-controlled script tag that executes in the channel if the HTML isn't sanitized first.
Slack's existing defense was a third-party HTML sanitization service. The interns' assignment was to build a standalone HTML sanitizer in Hack, replacing that external dependency with a library living directly in webapp, the monolith repository containing Slack's backend and frontend code.
The project split naturally into two phases: learning how sanitizers work, then building one. Early work meant scoping design choices and creating a roadmap before any implementation began. Reading documentation and exploring GitHub repos of similar internal projects surfaced both technical knowledge and the right people to ask for help—everyone approached was willing to assist.
With the two interns on opposite coasts—one in upstate New York, one in the Bay Area—the three-hour time difference could have slowed progress. Instead, five overlapping working hours were used for Slack discussions and Zoom pairing sessions on implementation strategy and debugging. Outside those hours, asynchronous Slack messages kept things moving in both directions.
Why the Library Matters
Because the new sanitizer runs inside webapp rather than as an external service, it eliminates extra calls to a third party and can handle a larger volume of requests without requiring separate scaling or management. The work also produced useful documentation: future engineers will have a clearer picture of how the library is structured, why it works the way it does, and what supporting additional unfurl types will require.
Transferable Lessons
Despite the unexpected circumstances, the internship ran smoothly. The skills developed in a distributed setting apply directly to in-office work: proactive outreach to colleagues builds relationships whether over video or a coffee break, identifying the right expert for a question improves efficiency, and clear, specific communication matters as much in person as over Slack.
Neither intern would trade the experience. Though meeting the team in person would have been ideal, the project's technical impact and the relationships built made it a summer to remember.
