Interning on Slack’s Product Security Team

This post details the development of a dependency vulnerability detection tool for Slack's codebase. The tool was initially focused on Javascript/npm packages and evolved to support Hack and Go. Key features include daily scans for new vulnerabilities, tracking remediation status, notifying owners, and visualizing dependency trees with force graphs to highlight direct dependencies and aid in fixing vulnerabilities. The post also discusses lessons learned regarding data modeling, notification granularity, and filtering false positives.