[zeyu2001]

Documents what the Slack assistant gained for the next release. Draft until that release reaches production. Security questions are switched off in production today (SECURITY_ARCHITECT_ENABLED=false in iva), and Slack credit charging (HacktronAI/web#1691) is on staging only.

Changes

• platform/slack-assistant.mdx
  • Ask security questions (new section): Hacktron as a security engineer you can pull into any conversation about a planned feature, a design doc or PRD, how part of the app handles access, or a change about to ship. It covers what Hacktron reads (your code at a branch or pull request, threat models, context documents, recent pentests and past findings), example questions, what the answer looks like, and the supported providers (GitHub, GitLab, Azure DevOps).
  • Keep your threat model up to date (new section): save decisions and PRDs, edit or update the threat model, and create or rebuild applications, all behind Approve.
  • Credits (new section): replies use the org's automation credits; when they run out, Hacktron says so with a Billing link, after an auto top-up if one is on.
  • Limits: a conversation ends after a week idle and its attachments are deleted. Bitbucket isn't readable yet.
  • Troubleshooting: the out-of-credits reply.
  • The task table, the Approve paragraph and the roles line cover the new actions.
• platform/automations/credits.mdx: replies from the Slack assistant use automation credits too.
• New image images/slack-assistant-security-review.png: a real staging thread in our test channel, answering a question about HacktronAI/pr-review-test#22 (our test repository, no customer data).

Checks

• pnpm lint and mintlify broken-links pass.
• Previewed with mintlify dev: the new anchors land correctly, the image renders at article width, and the table shows the new rows.
• The copy is written for customers and frames security questions generally, with pull requests as one example. I ran a humanizer pass on it (no em dashes or staged contrasts).
• Each claim checked against the code: role requirements (reading code: member; context document edits and threat model sync: member; creating applications and adding repositories: admin), the providers that can be read, the out-of-credits note and the one-week session timeout.

Before merging

• Merge with the production release that turns on SECURITY_ARCHITECT_ENABLED and ships web#1691.
• Add a changelog entry for that release.

🤖 Generated with Claude Code

[mintlify]

Preview deployment for your docs. Learn more about Mintlify Previews.

Project	Status	Preview	Updated
hacktronai	🟢 Ready	View Preview	Nov 1, 2026, 5:50 PM

[chatgpt-codex-connector]

Codex Review Summary

This comment shows the latest Codex review activity on this pull request.

Review	Status	Commit	Review trigger
📝 Code Review	✅ Completed 2026-11-01T17:49:26.883289Z	577000b	Draft marked ready

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review" or "@codex security review".

Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings.

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 577000bf1a

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[chatgpt-codex-connector]

Clarify which copy of an attachment is deleted

For users who attach sensitive code or PRDs, this wording promises that the Slack file itself disappears after a week. The surrounding behavior indicates that only Hacktron's retained copy expires, since the assistant can reread the thread but requires the file to be attached again; the original upload can therefore remain visible in Slack. State explicitly that Hacktron deletes its copy and clarify the retention of the original Slack file so users do not rely on a false deletion guarantee. .agents/skills/writing-docs/SKILL.mdL31-L33

Useful? React with 👍 / 👎.