Important: The previous Slack integration will be discontinued in August 2026.
For new users: The previous integration is no longer available. You must use the new integration.
For existing users: You can continue editing your existing integration until August 2026, but we recommend migrating now.
This new integration provides all the functionality of the previous integration, plus enhanced features.
Overview
The Slack integration lets you receive real-time HackerOne notifications directly in your Slack workspace. You can stay informed about report updates, bounties, disclosures, and other key program activities without leaving Slack.
This new integration replaces the legacy version, which will be discontinued in August 2026. We recommend switching as soon as possible to take advantage of improved reliability, enhanced configuration options, and support for multiple channels.
Key Features
Alerts for specific program activities
Notifications to multiple Slack channels
Simple setup and configuration
Setup
To set up your Slack integration:
Go to Engagements, click the kebab menu for your program, and select Settings.
Click Automations > Integrations.
Click Connect with Slack.
Click Set up new integration.
Enter a name and optional description for your integration. Click Next.
Select New Authentication, leave the text fields empty, and click Create.
You’ll be redirected to a Slack authorization screen where you’ll be asked to grant HackerOne Bot permissions to access your workspace. If you manage multiple Slack teams, select the one you want HackerOne to post to.
Click Allow to return to HackerOne and continue configuration.
Choose which HackerOne activities will send messages to Slack channels.
To send activities to multiple channels, enter channel names separated by commas.
For private channels, invite the HackerOne Bot using /invite @HackerOne Bot.
Optionally, map HackerOne usernames to Slack usernames. If a user isn’t listed, enter their Slack email address.
Click Finish, then enable your integration
Available HackerOne Activities
You can map HackerOne activities in the following categories:
Report lifecycle
Awards
Disclosure
Scope changes
Miscellaneous
FAQs
Missing Slack username?
Enter the user’s Slack email address manually. It will be matched to their Slack account.
Missing Slack channel?
For private channels, invite the HackerOne Bot using /invite @HackerOne Bot. If you still can’t find it, type the channel name directly.
Multiple channels for one activity?
Enter channel names separated by commas, for example: channel1, channel2, channel3.
Edit legacy Slack integration?
If you have a legacy integration, you’ll see two options on the Integrations page. Select Edit Legacy Slack.
How do I remove legacy Slack integration?
Go to Settings > Program > Integrations > Slack > Edit Legacy Slack, then click Disconnect in your Slack settings.
Do I need to fill in the User OAuth Token scope, Configuration Token, or Slack command signing secret fields?
No. You can leave these fields blank for the HackerOne Slack integration.
Why These Fields Exist
These options are part of Slack’s general connector and aren’t needed for HackerOne’s setup.
User OAuth Token Scope: Used to send messages as a specific user instead of a bot. HackerOne sends all notifications as a bot.
Configuration Token: Supports advanced Slack API configurations. HackerOne uses standard bot authentication and doesn’t need this.
Slack Command Signing Secret: Verifies slash commands. HackerOne sends notifications to Slack but doesn’t receive commands, so this isn’t required.
Do I need to wait for the loading indicator to disappear before progressing to the next screen?
No, you don't need to wait; it can load in the background. Once you have set your mappings, you can progress to the next screen.
Required Bot Permissions
Action | Required Bot Permissions |
chat:write | |
chat:write.public | |
channels:read groups:read | |
users:read | |
users:read.email |
Conclusion
After setup, verify that notifications appear in the selected Slack channels. You can update your configuration at any time to change which activities send messages, edit channel mappings, or disable the integration if needed.