At CloudFlare we use a self-hosted, and accessible via corp VPN only, Hipchat. However it's important to note that this is primarily information inbound, and n

At CloudFlare we use a self-hosted, and accessible via corp VPN only, Hipchat. However it's important to note that this is primarily information inbound, and not instructions outbound. Additionally, the disabling of a Hipchat account is near the top of the list of the security incident response team. If a laptop is lost, if a machine compromised, the ability for those accounts to continue broadcasting information of any kind is immediately neutralised. The risks are real, but one can mitigate them by: 1. Securing access to the chat environment (self-hosting, VPN only, different auth to this than to the rest of the infrastructure) 2. Not having chatops send instructions to other systems 3. Having well practised plans for disabling accounts in response to incidents 4. All of the above is no replacement for access control and auditing on all other systems I'm not going to speak on behalf of the security team, but the idea that the chatops would send instructions to systems is pretty horrifying even if they originated from a machine or person. It's bad enough to imagine the scenario that if someone's chat account were compromised and someone could gain access to the VPN to then use the chat, that social engineering via chat is likely to be more successful than by other mediums (people trust chat). Hence ensuring those accounts are disabled very quickly.