Skip to content
Open
Changes from all commits
Commits
File filter

Filter by extension

Filter by extension

Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
14 changes: 14 additions & 0 deletions backend/danswer/danswerbot/slack/handlers/handle_buttons.py
Original file line number Diff line number Diff line change
Expand Up @@ -295,6 +295,20 @@ def handle_followup_button(
unfurl=False,
)

# Ask user for debugging details
respond_in_thread(
client=client.web_client,
channel=channel_id,
text=(
"To help us debug your issue faster, please share the following details:\n"
"- *Environment* (e.g., Production, Staging, alpha)\n"
"- *TenantId* and *Organization Id* \n"
"- *ConnectionId*\n"
),
thread_ts=thread_ts,
unfurl=False,
)

Comment on lines +299 to +311
Copy link

Copilot AI Mar 6, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

This message asks users to share potentially sensitive identifiers (Tenant/Organization/Connection IDs) directly in the thread, which may be a public channel. Consider sending this prompt as an ephemeral message to the clicker (via receiver_ids=[req.payload['user']['id']]) or only posting it when is_dm is true, and otherwise instruct users to DM the bot/support channel with those details.

Suggested change
respond_in_thread(
client=client.web_client,
channel=channel_id,
text=(
"To help us debug your issue faster, please share the following details:\n"
"- *Environment* (e.g., Production, Staging, alpha)\n"
"- *TenantId* and *Organization Id* \n"
"- *ConnectionId*\n"
),
thread_ts=thread_ts,
unfurl=False,
)
debug_details_text = (
"To help us debug your issue faster, please share the following details:\n"
"- *Environment* (e.g., Production, Staging, alpha)\n"
"- *TenantId* and *Organization Id* \n"
"- *ConnectionId*\n"
)
if is_dm:
# In a DM, it's safe to ask for detailed identifiers in-thread.
respond_in_thread(
client=client.web_client,
channel=channel_id,
text=debug_details_text,
thread_ts=thread_ts,
unfurl=False,
)
else:
# In a non-DM channel, send the detailed request as an ephemeral message
# to the user who clicked, to avoid exposing identifiers in a public thread.
user_info = cast(dict[str, Any], req.payload.get("user") or {})
user_id = cast(str | None, user_info.get("id"))
if user_id:
client.web_client.chat_postEphemeral(
channel=channel_id,
user=user_id,
text=debug_details_text,
thread_ts=thread_ts,
)
else:
# Fallback: generic public message that does not ask for sensitive IDs
respond_in_thread(
client=client.web_client,
channel=channel_id,
text=(
"To help us debug your issue faster, please DM this bot or the "
"support team with your environment, Tenant/Organization ID, "
"and Connection ID."
),
thread_ts=thread_ts,
unfurl=False,
)

Copilot uses AI. Check for mistakes.
if action_id is not None:
message_id, _, _ = decompose_action_id(action_id)

Expand Down
Loading