Only the latest release of @nkootstra/block-kit gets security fixes. While the version is 0.x, upgrade to the newest minor release to receive them.

Report vulnerabilities privately through GitHub's private vulnerability reporting, not in a public issue. Include the affected version, what an attacker can do, and the steps or Block Kit JSON that reproduce it.

You'll get a reply within a week. Once a fix is released, the advisory is published with credit to you unless you'd rather stay anonymous.

Block Kit JSON often comes from somewhere the app doesn't control, so the package treats it as untrusted. In scope, for example:

• Block Kit JSON or mrkdwn that runs script, injects HTML, or renders a link, link button or overflow option whose URL isn't http:, https:, mailto:, slack: or relative (see URL safety).
• The signing secret given to createInteractionRelay reaching the browser, a response or a log.
• A relay that forwards a request it should refuse, or signs anything other than the interaction the page sent. For createInteractionRelay, that includes accepting a missing or wrong token when one is set, relaying a browser request from another site's page, and putting the app's request URL or a connection error in its response.
• The bot token given to createResolverRelay (or any WebClient the docs or examples set up) reaching the browser, a response or a log.
• The resolver relay accepting a missing or wrong token when one is set, calling anything but users.info, conversations.info and usergroups.list, or returning fields outside its allowlist, such as an email address or phone number.
• A published version without a provenance attestation (see below).

Out of scope: Slack's own services and APIs (report those to Slack), and what an app does with the interactions the relay forwards to it.

Releases are published from the Release workflow through npm trusted publishing: no npm token exists, and every version carries a provenance attestation linking it to the commit and workflow run that built it. Verify a release with npm audit signatures after installing it.