# Prevent Slack from unfurling anything for login-required sites

**URL:** <https://meta.discourse.org/t/prevent-slack-from-unfurling-anything-for-login-required-sites/75233>\
**Category:** Product Support\
**Created:** [Décembre 2, 2017, 12:52 UTC](https://meta.discourse.org/t/prevent-slack-from-unfurling-anything-for-login-required-sites/75233 "2017-12-02T12:52:40Z")\
**Posts on this page:** 1\
**Showing post:** 6

<div class="post-metadata">

**Author:** ![david](https://sea3.discourse-cdn.com/meta/user_avatar/meta.discourse.org/david/32/157490_2.png) [@david](https://meta.discourse.org/u/david)\
**Post date:** [Décembre 2, 2017, 9:25 UTC](https://meta.discourse.org/t/prevent-slack-from-unfurling-anything-for-login-required-sites/75233/6 "2017-12-02T21:25:18Z")

</div>

The [changelog](https://api.slack.com/changelog) suggests it was added in March, so yeah fairly recent.

In my opinion it would probably be better to keep it separate. The very nature of it (providing a backdoor to a discourse instance) is a potential security risk if not handled correctly, so it’s probably better that it’s only installed on those instances that really need it.

Also I think the slack API scopes required (`links:read` and `links:write`) are completely different to that of chat-integration, so there wouldn’t be much effort saved there by combining them.

---

_[View the full topic](https://meta.discourse.org/t/prevent-slack-from-unfurling-anything-for-login-required-sites/75233)._