Exposing onmessage wasn't the best idea. Instead it should be something more restrictive with origin check built in. addMessageListener("https://*.slack.com" h

Exposing onmessage wasn't the best idea. Instead it should be something more restrictive with origin check built in. addMessageListener("https://*.slack.com" https://*.slack.com", function(data){})