Is the Slack bot safe to install?

The Yeethook Slack app is a minimal, write-only integration. Here's what it can and cannot do.

What it does

The Yeethook Slack app uses a single Slack permission: Incoming Webhooks. This allows Yeethook to post notification messages to the specific channel you chose during setup.

That's it. There is no other functionality.

What it cannot do

The app has no ability to:

• Read messages in any channel, DM, or thread
• Access files, reactions, or user profiles
• List channels, users, or workspace information
• Respond to slash commands or shortcuts
• Receive events from your Slack workspace
• Open modals or interactive dialogs
• Access your Slack workspace via a persistent connection (Socket Mode is disabled)

Permission details

This is the most restricted scope available in Slack. It grants write access to a single channel that you explicitly select during installation. The app cannot post to any other channel unless you add another webhook.

No data flows from Slack to Yeethook

The integration is strictly one-way:

1. App Store Connect sends an event to Yeethook
2. Yeethook formats the notification
3. Yeethook posts it to your Slack channel via the webhook URL

At no point does Slack send any data back to Yeethook. There are no request URLs, no event subscriptions, and no callbacks configured.

Open source manifest

The Slack app is created from a manifest that you can inspect before installation. The manifest is defined in our codebase and validated against the official Slack JSON schema. During setup, Slack shows you the full manifest and requested permissions before you confirm.

Revoking access

You can remove the Yeethook app from your workspace at any time:

1. Go to api.slack.com/apps
2. Select the Yeethook app
3. Scroll to the bottom and click Delete App

Alternatively, you can revoke individual webhook URLs without deleting the entire app by going to Incoming Webhooks and removing specific URLs.