Possible leaked API key in this repository

Hi — an automated scan found what looks like a live **Slack (user token)** API key committed to this repository at:

- path: `cmd/generate/config/rules/slack.go`
- file: https://github.com/gitleaks/gitleaks/blob/9febafb621f407ec7fd0d398783fa3a63418f694/cmd/generate/config/rules/slack.go
- vendor rule: `slack-user`
- key fingerprint: `xoxp-416...` (sha256[:8] = `5eb3e0d0`, length = 72)

The scanner did **not** validate the key against the vendor's API — validating someone else's credential would be unauthorized access. Please treat the key as compromised regardless:

1. **Rotate the key immediately** in the vendor's console. Even if you have already removed it from the latest commit, it remains valid in git history.
2. Purge the key from history (e.g. `git filter-repo`) and force-push.
3. Move secrets to environment variables or a secret manager; never commit `.env` or equivalent config with live credentials.

The vendor's security team has been notified separately where a contact is known.

This issue was opened by an automated responsible-disclosure tool. Apologies for the noise if it is a false positive — please close the issue and I will not re-open it for this `(repo, rule)` pair.

Start by reviewing cmd/generate/config/rules/slack.go and the referenced commit, then inspect the repository history for the reported Slack user token. Follow the issue’s disclosure steps and repository security process; done means the credential is rotated and the secret is removed from reachable git history without exposing or validating it.

Written by the indexing model from the issue text.