Skip to content

Cross-Gateway Slack Message Leakage Between Separate Apps #828

@h-mascot

Description

@h-mascot

Bug: Cross-Gateway Slack Message Leakage

Summary

Messages sent to one Slack bot's DM channel are appearing in a different gateway's session.

Environment

  • Clawdbot version: 2026.1.11-4
  • Two separate gateways on different GCP VMs
  • Two separate Slack apps with different bot tokens and app tokens

Setup

  • Gateway A (ada-gateway): Slack app "Super Ada" (A0A6ZEKRRH7)

    • Bot token: xoxb-...-1021819...
    • App token: xapp-1-A0A6ZEKRRH7-...
    • DM channel with user: D0A6Q6J3ZHS
  • Gateway B (auntypelz-vm): Slack app "AuntyPelz" (A0A813NL7PG)

    • Bot token: xoxb-...-1026878...
    • App token: xapp-1-A0A813NL7PG-...
    • DM channel with same user: D0A7ZPY5X45

Bug Behavior

When user sends a message to Gateway B's DM (D0A7ZPY5X45), the message also appears in Gateway A's session with the metadata:

[slack message id: 1768285339.587399 channel: D0A7ZPY5X45]

Gateway A's bot token CANNOT access channel D0A7ZPY5X45 (verified via conversations.info returning channel_not_found).

Expected Behavior

Messages to D0A7ZPY5X45 should ONLY be received by Gateway B (AuntyPelz), not Gateway A (Super Ada).

Verified

  • Different Slack apps ✓
  • Different bot tokens ✓
  • Different app tokens ✓
  • No hooks configured from B to A ✓
  • No shared session storage ✓
  • Gateway A cannot access the DM channel via API ✓

Reproduction

  1. Set up two gateways with different Slack apps in same workspace
  2. DM each bot from same user account
  3. Messages to Bot B's DM appear in Bot A's session

Possible Causes

  • Slack socket mode event routing issue?
  • Workspace-level event subscription affecting both apps?
  • Session key collision?
  • Something else in Clawdbot's message routing?

Metadata

Metadata

Assignees

No one assigned

    Labels

    bugSomething isn't working

    Type

    No type
    No fields configured for issues without a type.

    Projects

    No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions