message: use hmac compare instead of direct compare
  As per - "Compare the resulting signature to the header on the request. Note: for best practice, use an hmac compare function instead of directly comparing the signatures for equality."
diff: @@ -247,7 +247,19 @@ function Slackbot(configuration) {
  .digest('hex');
  let retrievedSignature = req.header('X-Slack-Signature');
  - if (hash !== retrievedSignature) {
  + // Compare the hash of the computed signature with the retrieved signature with a secure hmac compare function
  + const validSignature = () => {
  +
  + const crypto = require('crypto');
  +
  + const slackSigBuffer = new Buffer(retrievedSignature);
  + const compSigBuffer = new Buffer(hash);
  +
  + return crypto.timingSafeEqual(slackSigBuffer, compSigBuffer);
  + }
  +
  + // replace direct compare with the hmac result
  + if (!validSignature()) {
  slack_botkit.debug('Signature verification failed, Ignoring message');
  res.status(401);
  return;
  