Connect Slack to get real previews for workspace and private apps. The card is gated on what YOU can open — and, because Slack has no per-person unfurl, it is visible to the whole channel.

Paste a VibeHost app link in Slack and you get a preview. For a public app that has always worked: Slack's crawler fetches the page and reads its og: tags, no account needed.

For a workspace or private app the crawler gets nothing useful — it is an anonymous visitor, and an anonymous visitor is not allowed to see your app, so all it can render is a generic "Protected by VibeHost" card.

Connecting your Slack account fixes that, by making the request no longer anonymous.

How it works

you paste a link in Slack
      ↓
Slack tells VibeHost: "user U123 in workspace T456 shared this URL"
      ↓
VibeHost looks up which VibeHost account U123 is linked to
      ↓
…and asks the ordinary question: can THAT person open this app?
      ↓
yes → a card with the app's name, description and screenshot
no  → nothing at all

No new permission is created. The card exists only because you could have opened the app yourself.

Connect your account

Settings → Integrations → Connect Slack. You will be sent to Slack to confirm who you are, then back. VibeHost asks Slack for your identity only — never for permission to read messages or post as you. The preview is posted by the VibeHost bot, not by you.

Disconnect from the same page at any time. Once disconnected, links you paste stop previewing non-public apps immediately.

What the channel sees

Slack has no per-person link preview. This is the part worth reading twice. Slack's own documentation is explicit that "everyone in a channel can see your app's unfurls" — there is no way to show a card to one person. So the permission check decides whether a card is created at all, not who can look at it.

Concretely: if you paste a link to a private app in a channel, everyone in that channel sees its name, description and screenshot, including people who cannot open the app itself. VibeHost sends you a private (ephemeral) reminder when that happens, so it is never a surprise.

This is the same trade-off Notion and Google Drive make in Slack. If a preview would say more than you want the channel to know, do not paste the link there.

About the screenshot

The screenshot in the card is the same one VibeHost captures for every deployment. Slack's servers fetch images themselves, carrying no identity, so the card's image URL has to be readable without signing in.

VibeHost issues a signed URL that expires after 15 minutes, minted at the moment the card is sent. Two things follow, and both are true:

The URL is not a permanent leak. It stops working, and it was only ever created for someone who could already open the app.
Within that window, anyone who obtains the URL can load the image, whether or not they have access in VibeHost. Slack also caches images on its own servers, so the picture can remain visible in the card after the URL itself has expired.

Nothing else changes: the crawler still gets nothing for a non-public app, and every other way of reaching a screenshot still requires the usual permissions.

Before you connect

If you have not connected your account and you paste a link to a non-public app, Slack shows you (and only you) a prompt to connect. No name, no description, no screenshot — there is no identity yet whose permissions could justify any of that.

The prompt itself does say one thing: that the link points at a VibeHost app which is not public. That is not new information — an anonymous request to the same URL already gets a "Protected by VibeHost" page, which is what Slack's own crawler renders for it today. And you are the person who already had the link.

Which links get previews

Links on VibeHost's app domain — the *.vibehost.space address of your app or one of its channels. Links on your own custom domain are not previewed, because Slack only sends these events for domains registered on the VibeHost Slack app.

Slack link previews