Slack: flash content type sniff vulnerability in api.slack.com

Hi, I have found a flash content type sniff vulnerability could allow attackers get user's team auth2 tokens. As the page lists user's teams and its security tokens, this could allow attackers to do csrf attacks. Steps to reproduce: 1. Log in api.slack.com 2. after go to...