Interning on Slack’s Product Security Team

The Slack Internship — Matt’s First Time at Slack I’m Matt and I’m a senior Computer Science student at North Carolina State University in Raleigh, NC (Go Pack!). In my free time I enjoy traveling, hanging out with friends, discovering new music on Spotify, running, and hiking. I’m also a self-proclaimed sushi enthusiast. Coming to…

Slack logo
Slack
•
Ryan Slama
•8 min read•intermediate•
--
•View Original
ChefMVPReact

Overview

The article discusses the experiences of interns Matt Dzwonczyk and Ryan Slama on Slack's Product Security Team, focusing on their project to detect vulnerabilities in JavaScript/npm packages through daily scans. It highlights the challenges faced, the solutions developed, and the impact of their work on improving Slack's security.

What You'll Learn

1

How to detect vulnerabilities in JavaScript/npm packages using automated scans

2

Why understanding dependency trees is crucial for managing security risks

3

How to effectively present security findings to engineering teams for better remediation

Prerequisites & Requirements

  • Basic understanding of JavaScript and npm package management
  • Familiarity with React and TypeScript(optional)

Key Questions Answered

What was the main challenge faced by Slack's Product Security Team?
The main challenge was auditing the use of external dependencies for security vulnerabilities, particularly with JavaScript and npm packages, which often require multiple nested dependencies. This issue is highlighted as one of the OWASP top ten most pressing security risks.
How did the interns approach the problem of detecting vulnerabilities?
The interns built a minimum viable product (MVP) that involved daily scans to detect vulnerabilities in JavaScript/npm packages. They focused on collecting real usage data and feedback to provide value to developers while tracking the status of vulnerabilities for remediation.
What were the results of the interns' project on vulnerability detection?
The interns were able to catch vulnerabilities quickly throughout the codebase, enhancing Slack's product security. They also provided visibility of open source usage risks to the Product Security team and service owners, which facilitated better risk management.

Key Statistics & Figures

Number of dependencies in main repository
over 3,000
This highlights the complexity of managing security in modern frontend applications, where a single package can introduce numerous vulnerabilities.

Technologies & Tools

Some links below are affiliate links. We may earn a commission if you make a purchase.

Frontend
Javascript
Used for developing the application and managing dependencies.
Package Manager
Npm
Used for managing JavaScript packages and their dependencies.
Frontend
React
Utilized in the development of the vulnerability detection tool.
Frontend
Typescript
Used to enhance the development process with type safety.

Key Actionable Insights

1
Implementing automated scans for dependency vulnerabilities can significantly enhance security.
This approach allows teams to proactively identify and remediate security risks before they can be exploited, thus improving the overall security posture of the application.
2
Visualizing dependency relationships through tools like force graphs can simplify vulnerability management.
By mapping out dependencies, developers can quickly identify which packages need attention, reducing the time spent on manual audits and improving efficiency.
3
Regularly presenting findings to stakeholders fosters a culture of security awareness.
Engaging with the broader engineering team through demos and feedback sessions helps in aligning security practices with development workflows, ensuring that security is a shared responsibility.

Common Pitfalls

1
Failing to account for the complexity of dependency trees can lead to overlooking vulnerabilities.
Many vulnerabilities reside deep within the dependency tree, making it essential to have tools that can visualize and track these relationships to ensure comprehensive security coverage.