{"version":"2.1.234","anchor":"slack-workflow-tokens-and-webhook-urls-are-scrubbed","canonical_anchor":"slack-workflow-tokens-and-webhook-urls-are-scrubbed","heading":"Slack workflow tokens and webhook URLs are scrubbed","tier":"notice","area":"Secret Redaction","scope":null,"heads_up":null,"url":"https:\/\/changelogs.core-directive.com\/v\/2.1.234\/e\/slack-workflow-tokens-and-webhook-urls-are-scrubbed","release_url":"https:\/\/changelogs.core-directive.com\/v\/2.1.234","markdown":"### Slack workflow tokens and webhook URLs are scrubbed\n\nSlack workflow tokens and webhook URLs are now scrubbed from text before it leaves your machine.\n\n**What**\n\nThe credential scrubber applied to text before it leaves the client now catches Slack workflow tokens beginning `xwfp-` and Slack webhook URLs under `hooks.slack.com\/services`, `\/workflows` and `\/triggers`, replacing them with a placeholder instead of letting them through.\n\n**Details**\n\n- Tokens are replaced with `[REDACTED-PAT]`; webhook URLs are replaced with their own placeholder.\n- Both patterns were added to every scrubber in the build, including the token table that already handled bearer and Basic headers, `sk-ant-` keys, GitHub and GitLab tokens and Slack `xoxb-` tokens.\n\n**Evidence**\n\n`hooks.slack.com\/<redacted>`, `[REDACTED-PAT]`\n\n- Area: Secret Redaction\n- Tier: You'll notice\n- Useful: 3\/5\n- Signal: 2\/5"}