# Leaking sensitive information on Github lead full access to all Grab Slack channels

Slack xoxp user token and Google OAuth secrets leaked in a public GitHub Electron release, granting full access to all Grab Slack channels.

- Payout: hidden
- Severity: critical
- Program: Grab
- Found by: xsam
- Disclosed: 2018-09-11
- Write-up quality: 7/10
- Original: https://hackerone.com/reports/397527
- Library page: https://bugbountylibrary.com/r/h1%3A397527
- Tags: area:web domain:web impact:data-leak impact:internal-access kind:bounty platform:hackerone sev:critical tech:electron tech:github-actions technique:recon technique:reverse-engineering vuln:info-disclosure vuln:secrets-leak

**Target:** Public GitHub repo with Electron app release artifacts (app.asar)
**Root cause:** Developer committed production/staging env JSON files and Google OAuth client_secret/token into an Electron app packaged and published as a public GitHub release, exposing a Slack xoxp user token.
**Steps:**
1. Find QA engineer's GitHub profile with a repo containing 30 releases but no source
2. Download `vnot-automation-support-1.0.34-mac.zip` release and unzip
3. Run the Electron app, open Environment > Toggle Developer tools > Sources to confirm Electron
4. `npm install -g asar`; `cd .../Contents/Resources`; `asar extract app.asar example-sourcecode`
5. Read `build/constants/google/client_secret.json` and `google_token.json`
6. Read `build/environement/production.env.json` containing `"slack": {"token": "xoxp-..."}`
7. Send `GET` to Slack API with header `Authorization: Bearer xoxp-...` to list channels
**How found:** After a prior secret-leak report, searched random GitHub profiles; noticed a repo with no source but 30 releases, suspected packaged secrets, and reverse-engineered the Electron asar to extract env files.
**Exploitation:** Using the leaked xoxp user token as a Bearer header against Slack Web API, the researcher listed ~100 channels including internal ones, equivalent to full user credentials even with 2FA.
**Escalation:** xoxp user token grants full user-level Slack access (chats, files) with no easy detection of eavesdropping; could expose production DB credentials and source code.
**Insight:** Repos with no source but many release binaries are prime targets: Electron apps ship app.asar containing bundled env/secret JSON; always `asar extract` release artifacts of a target's employees.