Hacktron in Slack

Mention @Hacktron AI in a Slack channel or direct message to ask security questions about your code and plans, work with your findings, set up a Whitebox pentest, or manage Review. Hacktron uses your Hacktron account and permissions, and replies in a thread.

You can keep going in that thread without mentioning it again. Teammates join by mentioning @Hacktron AI, and each person’s requests use their own account and permissions.

What you can ask it to do

Before Hacktron changes a finding, stops a scan, updates the Review settings, or changes your threat model or context documents, it shows you what will change and asks you to click Approve. Starting a pentest needs approval from an organisation admin.

Your Hacktron role decides what you can do:

• Viewers can ask questions.

• Members can also have Hacktron read your code, prepare pentests, and update context documents and threat models.

• Organisation admins can also start pentests, change the Review settings, and manage applications.

Set up

Connect your workspace

An organisation admin does this step. In Hacktron, go to Integrations and find Slack under Notifications. Click Connect, then Connect Slack in the panel that opens. Approve the Hacktron AI app for your workspace to install it. Slack has the full steps.

Slack under Notifications in Integrations, with a Connect button

Note

If Slack is already connected but Hacktron can’t read attached archives, disconnect Slack and connect it again from Integrations to grant file access.

Link your Slack account

In Hacktron, open Personal settings, find Connected accounts, and click Connect next to Slack. Choose the workspace connected to your organisation so Hacktron can match your Slack and Hacktron accounts. Link your Slack identity has the details.

Connected accounts in Personal settings, with a Connect button next to Slack

Add Hacktron AI to a channel

In Slack, open the channel and send /invite @Hacktron AI, or click the channel name, open Integrations, and click Add apps. Both work for public and private channels.

To send a direct message, find Hacktron AI under Apps in the Slack sidebar and send it a message.

Send your first request

Mention @Hacktron AI with a request. The first time, Hacktron sends you a private Connect Hacktron message. Click the button, sign in to Hacktron, and allow access. Hacktron waits for you to connect, then continues with your request in the thread.

Ask security questions

Pull Hacktron into any conversation the way you would a security engineer. Ask about a feature you’re planning, a design doc or PRD, how part of your app handles something like sign-in or file access, or a change you’re about to ship.

Hacktron answers from your own code and from what it already knows about your repositories. It can read the code at any branch or pull request, and it checks your threat models, context documents, recent pentests, and past findings.

A few things you might ask:

• “We’re adding file uploads to acme/web. What should we think about before we build it?”

• “How does acme/api check that a user can see another team’s projects?”

• “Here’s our PRD for shareable report links. What are we missing security-wise?” Paste the PRD into your message or attach it.

• “Is https://github.com/acme/api/pull/42 safe to merge?”

Hacktron starts with the few points that matter most for what you’re doing, and links each one to where it found it: a file and line, a related finding, or your threat model. If something important is still unclear, it ends with a question for you. Reply in the thread to keep going.

Hacktron answering a security question in a Slack thread, citing lines of code and linking a related finding

Hacktron calls something exploitable only when the code shows it, so treat its points as things to check. To confirm one, ask Hacktron to review the pull request or set up a pentest.

Ask about findings

Ask in your own words, for example:

• “How many critical findings are open in acme/api?”

• “Show me the high severity findings from the last pentest”

• “Which repositories have the most open findings?”

Hacktron can return counts or post finding cards that link to the details in Hacktron.

Act on findings and scans

Ask Hacktron to change a finding’s status, add a comment, stop a running scan, or discard a pentest draft. Review the proposed change and click Approve. Hacktron confirms the result in the thread.

Each finding card also has buttons to update its status or fix it with AI.

Keep your threat model up to date

When a conversation settles something, ask Hacktron to save it. Your scans, pull request reviews, and later answers then take it into account. Before each change, Hacktron shows an Approve button that describes it.

You can ask Hacktron to:

• Save a decision, requirement, PRD, or accepted risk from the thread as a context document on the repository.

• Edit the threat model, for example to add a trust boundary. Your edits stay in place when the threat model updates later.

• Update the threat model with new context documents and triage feedback. If a repository doesn’t have a threat model yet, Hacktron builds one from the code. Updates run in the background and take a few minutes.

• Create an application from your repositories, add repositories to it, or rebuild its threat model. Creating an application and adding repositories need an organisation admin.

Set up a pentest

Test a site signed in

If the live site requires a login, click Add login details to open a private form. The form sends your details directly to Hacktron, which stores them encrypted, and keeps them out of the Slack thread and the assistant’s conversation. Use the form rather than pasting credentials into Slack.

Hacktron then checks that it can sign in and posts the result in the thread. If the check fails, click Update login details to fix them.

A pentest uses the same access mode for all its live sites: signed in or without a login. To test both, create separate pentests.

Manage Review

Ask Hacktron to turn Review on or off for a repository. You can also change organisation settings, including whether reviews post comments, which finding severity fails the pull request check, and filters for target branches, labels, authors, and title keywords.

Anyone can ask to see the settings. Only organisation admins can change them, after reviewing the change and clicking Approve.

Ask how Hacktron works

Ask a product question, such as “How do I stop reviews of PRs into release branches?” Hacktron answers from the documentation and links to the relevant page. If the docs don’t cover your question, it tells you.

Follow what it’s doing

A progress card at the top of the reply shows Hacktron’s plan and the steps it takes.

Credits

Replies from the Slack assistant use automation credits from your organisation’s balance. Pentests and fixes you start from Slack cost the same as when you start them in Hacktron.

If your organisation runs out of automation credits, Hacktron tells you in the thread and links to Billing. With auto top-up turned on, Hacktron buys more credits first.

Limits

• The Slack assistant can read attached archives, but it doesn’t build or run your code. Give the URL of a deployed app for live testing.

• Each thread has a usage limit. When a thread reaches it, Hacktron stops and asks you to mention it in a new thread.

• A conversation ends after a week without activity, and any files attached to it are deleted. To pick it back up, mention @Hacktron AI in the thread. Hacktron reads the thread again, but you need to attach the files again.

• Hacktron can’t read code from Bitbucket repositories yet.

• If Hacktron can’t read an attachment, ask an organisation admin to disconnect Slack and connect it again from Integrations to grant file access.

Troubleshooting