The-Notorious-Avengers slack-app-weapon
The Slack developer playbook for slack-app-guardian. Encodes opinionated, research-backed patterns for every major Slack app surface — from first Bolt app scaffold to Marketplace submission.
Quick navigation
| Task | Guide |
|---|---|
| Create a new Slack app, pick HTTP vs Socket Mode | guides/00-setup-and-bolt.md |
| Add a slash command | guides/01-slash-commands.md |
| Build Block Kit messages and interactive components | guides/02-block-kit.md |
| Open / push / update modals | guides/03-modals.md |
| Subscribe to events, verify webhooks | guides/04-events-api.md |
| Multi-workspace OAuth install flow | guides/05-oauth-install.md |
| Submit to App Directory / Marketplace | guides/06-app-directory.md |
Critical directives
These are the non-negotiables. Violating any of them is the most common cause of production Slack app failures. See the relevant guide for code patterns.
Acknowledge Slack payloads within 3 seconds, then dispatch async for long-running work. Slack retries unacknowledged payloads up to 3 times and flags unreliable apps. This applies to slash commands, interactive component actions, and Events API deliveries equally. Source:
research/external/2026-05-20-events-api-verification.md,research/external/2026-05-20-slash-commands-interactive.md.Verify Slack request signatures before processing any payload. Bolt does this automatically. Custom HTTP handlers (Express, FastAPI routes) must implement HMAC-SHA256 verification manually using the app's signing secret. Source:
research/external/2026-05-20-events-api-verification.md.Never store Slack tokens in plaintext config files or committed environment variables. Bot tokens (
xoxb-) and signing secrets go in an environment variable manager or secrets vault. Source:research/external/2026-05-20-bolt-sdk-setup-patterns.md.Always validate the
stateparameter in OAuth callbacks. Bolt auto-generates and validatesstateviastateSecret. Bypassing this validation is a CSRF vulnerability that allows workspace installation hijacking. Source:research/external/2026-05-20-oauth-multi-workspace.md.Deduplicate Events API payloads using
event_idbefore processing. Slack delivers events at-least-once. Store theevent_id(Redis SETNX, DB unique constraint) and discard duplicates. Source:research/external/2026-05-20-events-api-verification.md.If the app will be distributed commercially at scale, use HTTP mode and plan for Marketplace submission from the start. Socket Mode apps cannot be listed in the Slack Marketplace. Apps intended for commercial distribution must go through Marketplace review (December 2024 policy update). Source:
research/external/2026-05-20-socket-mode-vs-http.md,research/external/2026-05-20-dev-policy-update.md.Never use Slack data to train LLMs. This is an explicit, absolute prohibition in the December 2024 Slack App Developer Policy update ("under any circumstances"). AI-powered Slack bots must not route user message content through LLM training pipelines. Source:
research/external/2026-05-20-dev-policy-update.md.
Scope note
This weapon covers the Bolt SDK (JS, Python, Java) and the classic Slack Platform. The Deno Slack SDK and the next-generation Workflow Builder platform are distinct products with separate documentation and are out of scope here. When developers encounter both in the official docs, direct them to https://tools.slack.dev/bolt-js/ (Bolt JS) vs https://tools.slack.dev/deno-slack-sdk/ (Deno/Workflow Builder) for the right starting point.
Handoff map
- Deployment infrastructure for the Bolt app backend (Lambda, Fly.io, Render): route to
devops-guardian. - Token vault, signing secret rotation, security audit: route to
security-guardian. - Django or FastAPI backend decisions beyond Bolt integration: route to
python-guardian. - Slack Connect or Enterprise Grid administration: out of scope; direct the user to Slack's enterprise documentation.
Forged by weapon-forge from ai-tools/command-briefs/slack-app-guardian-command-brief.md and research/. Part of the Legion AI Tools Factory.