How secure to make MVP? Specifically: hiding Slack tokens
Hi there 👋
Looking for some advice on balancing security with getting an MVP complete. My app integrates with Slack and this is about hiding tokens..
A big part of the app is displaying people's photos from Slack. I think there are 2 approaches I could take:
- Display photos by linking directly to the originals photos hosted on Slack (currently attempting)
- Re-upload Slack photos to storage I control, such as AWS S3
Approach #1 is simpler and faster. However, an auth token is required in order to get photos to load. I.e., the photo URLs become: https://slack.url/img/size1/etc/1234.png?authentication_token=123acb. For the technically minded, I have tried routing photo URL requests through a 'proxy' on my server but it is much slower and not ideal.
My security friends tell me this is unacceptable given that any user could see the token. Though, theoretically they'd only see (a) the bot user token which is very controlled & localised, and (b) these users would already have access to their Slack team so, it's not like they've gained further access...
How do I balance getting the MVP complete vs. making it secure enough? The security feedback is coming from the security people where I work (ideally my first test customer) so, anyone have any suggestions? Persevere?
