Guarding Credentials Before They Become a Liability
Slack’s security posture has long centered on invalidating exposed credentials before attackers can weaponize them. Since 2016, the company has used regex-based tooling to scan public code repositories and other internet-exposed surfaces for Slack tokens and webhooks. When a secret is found, it is immediately revoked and the owner is notified. That same philosophy now extends to passwords and session cookies, which are prime targets for credential-stuffing attacks and info-stealing malware.
Finding Exposed Passwords Without Storing Them
Password reuse remains a leading factor in account takeover incidents. A 2023 study found that 70% of takeover victims had reused the same password across multiple services, and 53% of those victims had multiple accounts compromised as a result. By 2023, roughly 29% of American adults had experienced at least one account takeover.
To counter this, Slack ingests threat intelligence feeds from partners who collect credential data from breaches, dark web forums, botnets, and malware logs. The challenge is that Slack stores passwords as salted hashes, while threat intelligence data typically arrives in plaintext. Direct comparison isn't possible, so Slack built a pipeline that salts and hashes each candidate credential before comparing it against its own database. The plaintext datapoint is then discarded permanently—Slack never accumulates or stores the raw intelligence.
The hashing process is deliberately resource-intensive to deter brute-force attempts, but Slack processes millions of credentials in reasonable time by splitting them into parallel batches within a job queue. When a match is found, the user's password is reset immediately and an email explains what happened along with recommended follow-up actions. If no match is found, the datapoint is discarded.
Invalidating Stolen Session Cookies
Session cookies are stored locally on a user's device, which means device compromise can expose them to attackers. Slack monitors for signs of cookie misuse internally, but also watches external threat intelligence streams for exfiltrated cookies. When one is identified, Slack invalidates it before it can be sold or used, often acting faster than attackers can process and weaponize the stolen data.
Cookie invalidation carries a user experience cost: it terminates the session and logs the user out. To minimize disruption, Slack's automation evaluates each compromised cookie against the user's geography and timezone. If the user is currently within their typical weekday working hours, invalidation is deferred to a window outside that range. Users outside their working hours have their cookies invalidated immediately.
Affected users receive an email notification about the cookie invalidation. Workspaces on Enterprise plans with Slack Audit Logs also get an audit event recorded for transparency.
Balancing Security With Usability
The system Slack built is grounded in the reality that stolen credentials are often harvested by malware and moved quickly through resale channels. By leveraging real-time threat intelligence, proactively invalidating exposed passwords, and carefully timing cookie revocations, Slack aims to neutralize threats before they cause harm—while keeping the experience as frictionless as possible for legitimate users. This approach extends the company's earlier work on session token invalidation to the broader credential landscape, making stolen passwords and cookies far less valuable to attackers.
