Skip to content

Security

  • Channel access filtering — Even with a user token that can search all workspace channels, results are always filtered to only channels the bot has been explicitly invited to. Users cannot access channels the bot hasn’t joined.
  • Token scope validation — FluidRAG validates both tokens on startup by calling auth.test. Invalid or expired tokens disable the integration gracefully.
  • Rate limiting — All Slack API calls include automatic retry with exponential backoff on rate limit responses (429), respecting the Retry-After header.
  • No webhooks required — FluidRAG only makes outbound API calls to Slack. No inbound endpoints or webhook URLs need to be exposed.