Security

Slack permissions

Who'll Do asks for these bot permissions, and nothing that reads your channel messages:

channels:read: See who is in a public channel, so we can pick from its members.
groups:read: See who is in a private channel the bot was added to, for the same reason.
chat:write: Post the assignment message, update it when someone presses Done or Can't, and send DMs.
commands: Provide the /wholl-do and /wholl-do-config slash commands.
users:read: Skip bots, deactivated accounts and people who are away, and use the scheduler's time zone.
usergroups:read: Pick from a Slack user group (/wholl-do pick @group).
app_mentions:read: Reply with the command list when someone @mentions the bot.
im:history: Reply with the command list when someone sends the bot a direct message. Messages are not stored.

Every request from Slack is checked against Slack's signing secret (HMAC-SHA256) with a timestamp window, and rejected if it does not match.
Stripe webhooks are verified with Stripe's signing secret, and each event is processed once.
All traffic is served over HTTPS.

The tokens Slack issues for your workspace are encrypted at rest (AES-256-GCM, Rails Active Record encryption) in our application database, which is not reachable from the internet. The encryption keys are kept separately, in encrypted credentials.
Application secrets (Slack and Stripe keys) are kept in encrypted Rails credentials, with separate files for development and production.
Passwords are stored as bcrypt hashes. Card details never reach us; Stripe handles them.
Uninstalling the app deletes your workspace's data; see the privacy page.

Only the operator of Who'll Do has access to the production server and database. Support never needs access to your Slack workspace.

Found a vulnerability? Email [email protected]. We reply within one business day.