The correct way to prevent this would be to constrain the input and validate it on output -- so that users cannot enter anything that's not a hex value, and Sla

The correct way to prevent this would be to constrain the input and validate it on output -- so that users cannot enter anything that's not a hex value, and Slack won't send back anything that's not a hex value in the theme. Even limiting the length of the input (and output) would mitigate the issue to some extent...