[joshstrange]

Also important to note it took Slack over a year to fix this issue often with long stretches of silence even with requests from the bug hunter.

[jwilkins]

Interestingly, I put the same bug in at HackerOne 9 months ago. It was closed as not applicable. So they had at least two independent reports of the same bug and failed to understand it, acknowledge it and then fix it.

Way to go slack.

If you have any critical data passing through slack, when you get owned, you won't be able to say say it wasn't entirely preventable.

[jwilkins]

One thing I can add from my analysis is that there aren't seperate counters for files/teams/etc. there's only one. So if a given id is used by a team, it won't be used as a file id.