Trust
Security
Everything a reviewer needs to approve an install, in one page. Questions: support@hijinks.team.
Slack permissions
Hijinks asks for seven bot scopes. None of them reads messages: there is no
channels:history, no groups:history, no im:history, and no
users:read.email.
| Scope | Why |
|---|---|
commands | Receive the /hijinks slash command. |
chat:write | Post questions, results and leaderboards into the channels where you play. |
im:write | Open a direct message with a member for async rounds and Know Your Team answers. |
app_mentions:read | React when someone @mentions hijinks in a channel. Only the mention itself is delivered. |
users:read | Show display names on leaderboards and results, and recognize Slack owners and admins so they get the matching Hijinks role. |
channels:read | List the public channels the bot is in, for the channel picker in the dashboard. |
groups:read | List the private channels the bot has been invited to, for the same picker. |
The app subscribes to five events:
| Event | Used for |
|---|---|
app_home_opened | Render the bot’s home tab. |
app_mention | Respond to an @mention. |
app_uninstalled | Start the 30-day deletion clock. |
tokens_revoked | Stop using a revoked token immediately. |
user_change | Take a deactivated member off the roster and stop messaging them. Every other profile change is ignored. |
Signing in to the dashboard with Slack is a separate OpenID Connect flow with the scopes
openid email profile; that is where your email address comes from, not from the
bot. A member Slack reports as deactivated leaves the roster and gets no more messages, but
their data stays until the workspace is deleted or you ask us to remove that person by email.
Who can see what
- Installer → owner. Whoever installs the app becomes the workspace owner in Hijinks. On Slack, workspace owners and admins get the owner or admin role automatically when they sign in to the dashboard.
- Admins change settings and can export all workspace data as one JSON file: workspace settings, members and roles, custom questions, every game with its questions and per-player scores, celebration dates and Know Your Team answers.
- Owners are the only role that can delete the workspace, and they type the workspace's name to confirm.
- Members see and delete their own birthday and anniversary from the bot's home tab.
- Hijinks staff can reach the database and the dashboard's operator views (reported questions, user list) to run the service. There is no customer-data browsing beyond support requests and incidents.
Public results pages
A finished game can post a link to a results page (display names and scores, no platform
IDs). The token is 131 bits of randomness and is the only credential; the page is
noindex; an unknown token and a disabled workspace return the same 404. It is on
by default and the owner can turn it off in settings, which also disables every existing
link.
Encryption
- All traffic to the API, the dashboard and the site is HTTPS with Let's Encrypt certificates.
- Platform bot tokens and webhook signing secrets are encrypted at rest with AES-256-GCM under a key that lives only in the server's environment, never in the repository or in backups.
- Dashboard sessions are short-lived JSON Web Tokens (one hour).
Hosting and backups
The database, the CRM, analytics and outgoing mail run on servers rented from Hetzner in the EU. The database is dumped nightly; dumps are kept for 14 days and then deleted. Backups are restored only to recover from a failure, never to bring deleted data back. Error reports go to Sentry (stored in Germany) with request bodies, cookies, query strings and authorization headers removed before they leave the server or the browser; the full processor list is in the privacy policy.
Deletion
Uninstalling the app starts a 30-day clock; a daily job then deletes the workspace and every row that belongs to it, child tables first, in one transaction. Any subscription is canceled first, and if the billing provider refuses, nothing is deleted and we retry. Deleting the workspace from Settings → Data runs the same erasure immediately. A copy can remain in a nightly backup for up to 14 further days.
Webhook API
Teams that connect another chat tool run a small bridge that exchanges signed HTTP events with Hijinks. The guarantees, in both directions:
- Signing. Every request carries
Hijinks-Signature: t=<unix seconds>,v1=<HMAC-SHA256>over the raw body, verified in constant time; a timestamp more than 5 minutes off is refused. - Rotation. After a secret rotation both secrets are accepted for 24 hours, and outbound events are signed with both, so a bridge keeps verifying until it is redeployed.
- Rate limits per workspace and per source IP, checked before the signature so unsigned traffic is refused cheaply.
- SSRF protection. A bridge URL must be HTTPS. We resolve its host when the URL is saved and again before every send, refuse any name that resolves to a private, loopback, link-local or reserved address (even one address among several), and then connect to exactly the addresses we checked, so a DNS answer cannot change between the check and the connection.
- Replay. A replayed answer is harmless because each member's first answer is the one that counts; commands are not deduplicated, so a transport that can replay should deduplicate on its side.
The full contract, with a verification walkthrough and a reference bridge, is in the developer portal.
Egress address. Every event we deliver to a bridge leaves from one static IP address, so you can allow-list exactly one source in front of your bridge. The address is shown in the dashboard next to your inbound URL, when you connect the platform and afterwards on its Settings page.
Incidents and vulnerability reports
If we confirm a breach affecting your workspace's data, we email the workspace's owners within 72 hours of confirming it: what happened, which data it touched, and what we are doing about it. Where the GDPR requires it, we notify the supervisory authority within the same 72 hours. To report a vulnerability, email support@hijinks.team; the same contact is published at /.well-known/security.txt. Please give us a reasonable time to fix before disclosing, and do not access data that is not yours. Hijinks is in private beta and has no bug-bounty program.
Mirrors the configuration as deployed in October 2026. Legal entity, address and the data processing agreement: imprint and privacy policy.