Step 3: Keep Your Slack Secrets Safe in NetSuite

A Slack webhook URL or bot token is a key. Whoever holds it can post into your workspace as your app, and with a bot token they may be able to read user details as well. So it is worth spending a few minutes to store these carefully.

This page is deliberately practical: what to do, what not to do, and how to recover if something leaks.

The golden rules

1. Never hard-code a secret in a script file. Script files are readable by anyone with File Cabinet access, get copied into sandboxes, and end up in version control.
2. Never paste a secret into a chat, ticket or screenshot.
3. Give each purpose its own webhook or token where you can. If one leaks, you replace one thing.
4. Only request the Slack permissions you need.
5. Know how to rotate. Practise it once, so it is calm when you need it.

Where secrets can live in NetSuite

A sensible path

• Sandbox and testing: a script parameter is fine.
• Production: use API Secrets for the bot token and signing secret, and restrict who can view or edit the script deployment.

Oracle’s help topics on API Secrets and secure strings describe the exact way to reference a stored secret from N/https and N/crypto. Those method details have changed between releases, so read the current help page instead of trusting a blog post (including this one) for the precise syntax.

Step-by-step: lock down a parameter-based setup

If you are keeping the webhook in a script parameter for now, do at least this:

1. Go to Customization > Scripting > Script Deployments and open your deployment.
2. On the Audience subtab, limit the roles that can run it.
3. Make sure only administrators and named developers have the permissions to view and edit scripts (Lists > Customization style permissions: SuiteScript, Script Deployment).
4. Check that the sandbox copy uses a test webhook pointing at a test channel, not production. After a sandbox refresh, NetSuite copies your parameters over, so it is easy to alert real people from a test system by accident. Make this part of your refresh checklist.

Step-by-step: use an API Secret (recommended for production)

1. Go to Setup > Company > API Secrets (you need the right permission; ask your administrator if you do not see it).
2. Click New and give the secret an ID and a friendly name such as Slack Bot Token.
3. Paste the token value and save. From now on the value is hidden.
4. In your script, reference the secret by its ID following the pattern in Oracle’s current documentation for N/https secure strings.
5. Repeat for the signing secret if you use interactive features.

What to do if a secret leaks

Do these in order, and do not be embarrassed, it happens to everyone.

1. Revoke it at the Slack end. For a webhook, remove it under Incoming Webhooks in your app settings. For a bot token, use Reinstall to Workspace or revoke tokens in the app settings.
2. Create a replacement and update NetSuite.
3. Check the Slack audit logs or channel history for anything that should not be there.
4. Find out how it leaked (a screenshot, a support ticket, a script in a public repository) so it does not happen again.

Careful with what you send, too

Secrets are not the only sensitive thing. Before you put NetSuite data in a Slack message, ask:

• Who is in this channel today, and who might be next month?
• Is it acceptable for a contractor or a guest to see this?
• Could I send a link to NetSuite instead of the data itself?

A good default is to include an order number, a customer name and a link, and to leave out anything like bank details, personal addresses, tax IDs or confidential pricing.

Quick checklist

• ☐ No secrets in script files
• ☐ Separate webhooks for sandbox and production
• ☐ Bot token and signing secret in API Secrets for production
• ☐ Script deployments restricted to the right roles
• ☐ A note somewhere about how to rotate each secret
• ☐ Messages contain links, not sensitive details

What is next

With your credentials tucked away, let us make the messages look good. Step 4 introduces Block Kit for tidy, professional-looking alerts.