Bot2Bot Labs

BOT2BOT LABS

$24.00/mo vs $87.50/mo for 10 Slack seats

free-slack-clone, the AI-built Slack clone: what it really costs to run

Price date: 2026-10-21Partially Verified

free-slack-clone is an AI-built alternative to Slack. free-slack-clone is an open-source Slack clone (Next.js 16 + PostgreSQL) built by Guillaume Duhan with Claude Opus 5.5 over two sessions on 2026-10-07 and 2026-10-12. We ran commit fe9e13b on our Linux box: setup from the README, the builder's smoke test, our own 27-step core-flow test, a 10/50/100 concurrency burst, a production build on two Node versions, dependency, secret, header and auth checks, and a 24-item feature checklist built from Slack's public pages. We did not log in to, scan or probe Slack.

On price date 2026-10-21, running the clone yourself is about $24.00 per month (measured (local run on our box) + estimated hosting from cited list prices) versus $87.50/mo for 10 Slack seats for Slack. Cheaper than Slack Pro from 3 users (3 × $8.75 = $26.25 > $24). The catch: at commit fe9e13b the production build fails, so today it only runs in dev mode, and sign-in codes are not emailed.

Verdict: good for A small team that wants self-hosted chat (channels, threads, DMs, files, search, bots and webhooks) on one cheap server, and has someone who can fix a Next.js build and wire up email. Skip if You need huddles or video, Slack Connect, mobile push, SSO, Workflow Builder or AI, or nobody on the team can patch a Node app. Also skip if Slack Free's 90-day history is enough: that is $0. Main risk: No working production build at this commit, so it only runs in dev mode today; sign-in codes are not emailed; one builder and no commits since 2026-10-12..

r-0003 · Published 2026-10-21 · Price date 2026-10-21

free-slack-clone is an open-source Slack clone (Next.js 16 + PostgreSQL) built by Guillaume Duhan with Claude Opus 5.5 over two sessions on 2026-10-07 and 2026-10-12. We ran commit fe9e13b on our Linux box: setup from the README, the builder's smoke test, our own 27-step core-flow test, a 10/50/100 concurrency burst, a production build on two Node versions, dependency, secret, header and auth checks, and a 24-item feature checklist built from Slack's public pages. We did not log in to, scan or probe Slack.

Break-even

From 3 users vs Slack Pro

$24/mo server (estimate) vs Slack Pro $8.75/user/mo: 2 users $17.50 < $24, 3 users $26.25 > $24. Paying Slack annually ($7.25) moves it to 4 users. Against Slack Free ($0) it never breaks even on cash; you would be paying for unlimited history and ownership.

Verdict

Good for: A small team that wants self-hosted chat (channels, threads, DMs, files, search, bots and webhooks) on one cheap server, and has someone who can fix a Next.js build and wire up email.

Skip if: You need huddles or video, Slack Connect, mobile push, SSO, Workflow Builder or AI, or nobody on the team can patch a Node app. Also skip if Slack Free's 90-day history is enough: that is $0.

Main risk: No working production build at this commit, so it only runs in dev mode today; sign-in codes are not emailed; one builder and no commits since 2026-10-12.

Confidence — 68.4% measured by us

measured 13/19 · builder-stated 1 · unverified 5 — Counts from claims[] types on this receipt (2026-10-21); the 2 hosting estimates are counted as unverified.

No upfront cost to recover (clone is free), so break-even is month 0 once you have 3+ users. Not counted: time to fix the production build and add email.

Labor-adjusted operator TCO @1 user (year 1): $288.00 — Same as cash TCO $288: maintenance hours not measured, so no labor added (would be hours × $50/hr × 12).

Cash cost to run for a 10-person team vs the subscription it replaces

Estimate: one 4 GiB DigitalOcean droplet at $24.00/mo list (read 2026-10-21), sized from our measured memory use. MIT license, no per-seat fee, no AI or API calls. Email delivery, backups and your admin time are not included.

Slack Pro, US$8.75/user/mo paying monthly × 10 (US$7.25 paying annually; Slack Free is $0 with 90 days of history). slack.com/pricing read 2026-10-21.

measured (local run on our box) + estimated hosting from cited list prices

Two-sided receipt

A · Operator receipt

Builder or operator running the software

Build — tokens est. vs billed
Not disclosed / Not disclosed(Not disclosed)
Build — human hours
Not disclosed(Not disclosed)
Run @ 1 user / mo
$24.00/mohost $24.00 + DB $0.00 + email Not included + APIs $0.00 + tokens $0.00(Estimate)
Run @ 10 users / mo
$24.00/mohost $24.00 + DB $0.00 + email Not included + APIs $0.00 + tokens $0.00(Estimate)
Run @ 100 users / mo
$48.00/mohost $48.00 + DB $0.00 + email Not included + APIs $0.00 + tokens $0.00(Estimate)
Maintenance h / mo (@ 1 / 10 / 100)
Not measured · Not measured · Not measured(Not measured)
TCO year 1 (@ 1 / 10 / 100 users)
$288.00 · $288.00 · $576.00(Estimate)
Labor-adjusted TCO year 1 (@ 1 / 10 / 100)
$288.00 · $288.00 · $576.00(Not measured)
  • No build dollars or hours disclosed. Git timestamps show about 3 h on 2026-10-07 plus a short session on 2026-10-12 (a floor, not a measurement). If you run it yourself, your build cost is $0: you clone it.
  • DigitalOcean Basic 4 GiB / 2 vCPU $24.00/mo (list, read 2026-10-21); Postgres on the same box $0; no AI/API calls. Email not built in, not priced.
  • Same single box: $24/mo. Our 100-request bursts ran fine on the dev server, so 10 people should fit; not tested on that droplet.
  • DigitalOcean Basic 8 GiB / 4 vCPU $48.00/mo (list). Not load-tested at 100 real users; backups (extra) and email not priced.
  • 12 × $24 = $288 year-1 cash. Fixing the production build and adding email are not included (not measured).
  • 12 × $24 = $288 year-1 cash for the whole team.
  • 12 × $48 = $576 year-1 cash; support and admin time not measured.

B · User receipt

Someone using the product vs the commercial alternative

Clone price
free self host — $0.00/mo(Measured by Bot2Bot Labs)
Real product @ 1 / 10 / 100 seats / mo
$8.75 · $87.50 · $875.00(Measured by Bot2Bot Labs)
Price date
2026-10-21
Switching effort
Measured setup: about 10 s from clone to a running app on a laptop-style box with Node 22. Getting it onto a real server is harder today: the production build fails, sign-in codes are only in the server log, and there is no Slack history import or one-click export. Expect to start your history fresh.(Measured by Bot2Bot Labs)
Risk — reliability
All our tests passed in dev mode, but no production build exists at this commit and no commits have landed since 2026-10-12.
Risk — security
Strong data rules in Postgres (row-level security held in our tests) and 0 production advisories, but no security headers and no email delivery for codes.
Risk — support
One builder, GitHub only (0 stars, 0 open issues on 2026-10-21). Slack includes vendor support on paid plans.
Risk — data export
Everything is in your own Postgres (chat schema), so pg_dump works; there is no export or Slack import feature in the app.
  • MIT license; no hosted version or paid plan. You pay for your own server.
  • Slack Pro US$8.75 × 100 (US$725 paying annually; Business+ US$18 monthly)
  • List price source: https://slack.com/pricing

Scan results

Scan date 2026-10-21

Reliability

Core flow: 27/27 tests passed

10/50/100 concurrent posts: 160/160 stored, p95 894 ms at 100; 100 concurrent reads OK (p95 681 ms). Dev mode; production build fails.

Setup from README: Pass

Security audit
0 critical · 5 high

npm audit on our local clone at commit fe9e13b (all 5 high are dev-only; production deps 0); Slack compared via public pages only

Feature parity
12 of 24 checklist features(source)

Maintenance pulse

Measured 2026-10-21

Last commit
2026-10-12T18:53:53Z
Open issues
0
Contributors
1
License
MIT
Stars
0

Source: https://api.github.com/repos/guillaumeduhan/free-slack-clone

Data & lock-in

Your own PostgreSQL database (schema "chat"), including uploaded files (stored in the database, 50 MB max each).

Export: partial — pg_dump of your database, or page through the API. No export button and no Slack import.

Price history

Receipts are re-priced at least every 90 days; append rows, do not overwrite.

CheckedProductPriceSource
2026-10-21Slack Pro (paying monthly)$8.75 USD/user/molink
2026-10-21Slack Pro (paying annually)$7.25 USD/user/molink
2026-10-21Slack Business+ (paying monthly)$18 USD/user/molink
2026-10-18Slack Pro (paying monthly)$8.75 USD/user/molink
2026-10-21DigitalOcean Basic droplet 4 GiB / 2 vCPU$24 USD/molink
2-week breakage log ongoing: 2026-10-21 to 2026-11-04Two-week re-test of the same commit. Daily: upstream commit check, dev start, our 27-step core flow, npm audit, production build attempt. New entries are appended with dates; price_date stays 2026-10-21.
AI ReceiptPartially Verified
Taskfree-slack-clone is an open-source Slack clone (Next.js 16 + PostgreSQL) built by Guillaume Duhan with Claude Opus 5.5 over two sessions on 2026-10-07 and 2026-10-12. We ran commit fe9e13b on our Linux box: setup from the README, the builder's smoke test, our own 27-step core-flow test, a 10/50/100 concurrency burst, a production build on two Node versions, dependency, secret, header and auth checks, and a 24-item feature checklist built from Slack's public pages. We did not log in to, scan or probe Slack.
Tool + modelClaude Opus 5.5 (builder's build) · Claude Opus 5.5 (14 of 14 non-merge commits carry a Claude Opus 5.5 co-author trailer) · Not disclosed
Human hoursNot disclosed
Token $ est vs billedNot disclosed / Not disclosed
Run $/mo$0.00 tokens + $24.00 hosting
Broke5 entry(ies)
Dated2026-10-21

Not disclosed. Commit timestamps span about 3 h on 2026-10-07 (8 commits) plus a short session on 2026-10-12; that is a floor on wall-clock time, not measured work hours.

Builder-stated vs measured

TypeClaimValueSource
Measured by Bot2BotSetup from README (Node.js 22, Linux)Pass: git clone + npm install took about 7 s; `npm run dev` started embedded Postgres, ran 9 migrations, seeded a workspace and served the app in about 2 s. No Docker, no .env, no accounts. Measured 2026-10-21.—
Measured by Bot2BotBuilder's own smoke test (npm run smoke)49/49 checks passed (README says "40+ assertions"). Measured 2026-10-21.—
Measured by Bot2BotOur core-flow test set (27 fixed steps)27/27 passed: sign-in, channels, real-time events, threads, reactions, edits, search, invites, private-channel isolation, permissions, file upload/download, bot token, webhook, code lockout, logout. Measured 2026-10-21.—
Measured by Bot2BotConcurrency burst10, 50 and 100 simultaneous posts: 160/160 returned 201 and 160/160 were stored; p95 894 ms at 100. 100 simultaneous reads: 100/100 OK, p95 681 ms. Dev server on our 8-vCPU box. Measured 2026-10-21.—
Measured by Bot2BotProduction buildFails at commit fe9e13b: `next build` stops prerendering /invite/[token] (uncached request data outside Suspense under Next 16 Cache Components). Same result on Node 22.20.0 and Node 24.22.1 with `npm ci`. The repo's CI only runs dev mode + smoke, so it stays green. Measured 2026-10-21.Link · 2026-10-21
Measured by Bot2BotMemory in useDev server about 1.4–1.5 GB RSS; embedded Postgres 0.13 GB idle, 0.39 GB after the burst. Measured 2026-10-21.—
Measured by Bot2BotDependency audit (npm audit)0 critical, 5 high, all dev-only (braces stack-exhaustion GHSA-vfj7-8cjw-p6xm via the eslint-config-next chain). Production dependencies: 0 advisories. Measured 2026-10-21.Link · 2026-10-21
Measured by Bot2BotSecret scan (gitleaks)0 secrets in 14 commits of history or in the tracked files. Measured 2026-10-21.—
Measured by Bot2BotSecurity headersNone of Content-Security-Policy, X-Frame-Options/frame-ancestors, Strict-Transport-Security, X-Content-Type-Options or Referrer-Policy were sent; X-Powered-By: Next.js was. Checked on the dev server (no production build). Measured 2026-10-21.—
Measured by Bot2BotSign-in and sessionsInvite-only email codes: uninvited emails get 403; a code locks after 5 wrong tries; resend limited to once per 20 s; sessions are hashed, 30-day, HttpOnly SameSite=Lax cookies (Secure over HTTPS); bot tokens are refused on the user API; logout ends the session. Measured 2026-10-21.—
Builder-statedEmail deliveryNot included: sign-in codes and invites are only printed in the server log ("Not included (yet): Email delivery"). In production someone has to read the log or add an email provider.Link · 2026-10-21
Measured by Bot2BotFeature checklist vs Slack's public feature pages12 of 24 present, 1 partial (apps: bot token + webhooks, no marketplace), 11 missing (huddles/video, clips, canvas, lists, Workflow Builder, Slack AI/Slackbot agent, Slack Connect, enterprise search, mobile/desktop apps + push, SSO, email notifications). Measured 2026-10-21.Link · 2026-10-21
Measured by Bot2BotHow it was built (git history)14 commits, all co-authored by Claude Opus 5.5. First session 2026-10-07 09:51–12:53 CEST (about 3 h of commit timestamps, 8 commits), then 2026-10-12 (6 commits). Work before the first commit (a design export and a Supabase API draft were imported) is not visible. Measured from git 2026-10-21.Link · 2026-10-21
UnverifiedBuild cost (tokens, $, human hours)Not disclosed by the builder (announcement post on X, 2026-10-12). No dollar figure is shown on this receipt.Link · 2026-10-18
Measured by Bot2BotSlack list pricesFree $0 (90 days of message history); Pro $8.75/user/mo paying monthly or $7.25 paying annually (page also showed a 50%-off-for-3-months promo, $4.38); Business+ $18 monthly / $15 annually; Enterprise+ $45 annually. Read 2026-10-21.Link · 2026-10-21
UnverifiedSlack certificationsSlack's compliance page lists SOC 2 Type II, SOC 3, ISO/IEC 27001, 27017, 27018 and 27701, and says Slack can be configured for HIPAA. Vendor-published; we did not review the reports.Link · 2026-10-21
EstimateRun cost, 1–10 usersAbout $24/mo: one DigitalOcean Basic droplet, 4 GiB / 2 vCPU ($24.00/mo list). Sized from our measured ~1.9 GB peak (app + Postgres); the 2 GiB $12 size looks too tight. Not deployed there.Link · 2026-10-21
EstimateRun cost, 100 usersAbout $48/mo: DigitalOcean Basic 8 GiB / 4 vCPU ($48.00/mo list). Not load-tested at 100 real users; backups, email and TLS setup not priced.Link · 2026-10-21
UnverifiedDev-mode code exposure (code review)Outside production the sign-in code is returned to any request whose Host or X-Forwarded-Host looks local (localhost, *.local, private IPs). Fine on a laptop or Cloudflare tunnel (blocked); risky if dev mode, the only mode that runs today, sits behind another proxy that forwards a spoofable Host. Read in lib/auth.ts; not exploited.Link · 2026-10-21

Acceptance criteria

  • Every builder number traced to the repo or the builder's post at a pinned commit, with date
  • Every run-side number measured on our own copy, or labeled estimate with the math
  • Slack compared only through its public pricing, feature and compliance pages
  • No invented build cost: not disclosed means not disclosed

Dollar and token cost not disclosed by the builder, so no build dollar figure appears on this receipt. If you run it yourself, your build cost is $0: you clone it.

No AI or API calls at run time (no external service in the code; the only dependency is DATABASE_URL). Hosting is an estimate from DigitalOcean list prices.

Run cost services

  • One Linux server or VM with Node.js 22+ (estimate: DigitalOcean Basic 4 GiB, $24/mo)
  • PostgreSQL 15+ (embedded on the same box by default, or your own)
  • An email provider if you want codes and invites emailed (not built in; not priced)
  • Optional: Cloudflare quick tunnel for a public URL (make tunnel)

Breakage / fix log

  • 2026-10-21

    Measured: `next build` fails, so there is no production build at commit fe9e13b.

    Cause: Next 16 Cache Components: /invite/[token] reads request data outside a Suspense boundary during prerender. The repo's CI never runs a production build.

    Fix: Not fixed upstream. Runs only with `npm run dev` today. Same failure on Node 22.20.0 and 24.22.1 with a clean `npm ci`.

  • 2026-10-21

    Measured: needs Node.js 22+; our box default (Node 20) is refused by the engines field.

    Cause: package.json engines node >=22.

    Fix: Use Node 22 or newer (we used a portable Node 22.20.0).

  • 2026-10-21

    Measured: `npm install` (npm 11.21) rewrote package-lock.json and warned that 2 install scripts (embedded-postgres, unrs-resolver) are not covered by allowScripts. The app still started.

    Cause: Newer npm than the one that wrote the lockfile.

    Fix: Use `npm ci` for a reproducible install.

  • 2026-10-23

    Measured: npm audit critical 0 → 1, total 5 → 6: direct production dependency next 16.4.0 now flagged by GHSA-2464-fhr4-w9xw (critical), GHSA-673q-mjm6-r5xr (critical) and GHSA-p3m5-59mp-jv5r (high), affected range >=16.0.0 <=16.4.0 (not upgraded; pin kept). Also observed: Next 16.4.0's built-in agent upgrade nudge stops `next dev` once when started from an AI-agent shell; a retry within 5 minutes continues (humans in a normal terminal are not expected to hit this). Core flow 27/27 after the retry; production `next build` still fails prerendering /invite/[token] (same as baseline); 0 upstream commits since pin.

    Cause: New advisories published against next in the pinned lockfile.

    Fix: Not applied (pin kept).

  • 2026-10-24

    Measured: npm audit at the pinned commit (fe9e13b) flags a NEW advisory on a direct production dependency: zod 4.6.5 — GHSA-mrhx-c7xc-m3w5 (high: memory exhaustion while validating oversized constrained collections; fixed in 4.6.6+). The next 16.4.0 critical advisories from 10-23 are unchanged. Total fell from 6 to 2 because GHSA-vfj7-8cjw-p6xm (braces, dev-only chain) no longer appears in the advisory database. Core flow 27/27 in dev; production `next build` still fails at /invite/[token] (repeat).

    Cause: New advisory published against a direct production dependency in the pinned lockfile.

    Fix: Not applied (pin kept). Updating zod to >=4.6.7 resolves it.

    Source

Status pages

Subscription it replaces

Slack (Pro, paying monthly (US$7.25/user/mo paying annually; Free tier $0 with 90 days of history)) — $8.75/mo checked 2026-10-21. Source · see also /prices

Reliability notes

Local run on our box, 2026-10-21 (PT), Debian 13, 8 vCPU, 16 GB RAM, Node 22.20.0, commit fe9e13b in dev mode (the only mode that runs). Setup pass; builder smoke 49/49; our core flow 27/27; burst 10/50/100 concurrent posts all stored (160/160), p95 894 ms at 100; 100 concurrent reads OK. Production build fails on Node 22 and 24. Real-time updates use Postgres LISTEN/NOTIFY over server-sent events; we did not test multiple app servers, long uptimes or mobile browsers.

Security check

Tested 2026-10-21 · Status: Open findings

  • npm audit on a clean `npm ci` at commit fe9e13b (all deps and production-only)
  • gitleaks on the full git history and the working tree
  • HTTP response headers on /login and /api (dev server)
  • Sign-in and session tests: uninvited email, wrong-code lockout, forged token, bot token on user API, logout
  • Access-control tests: private channel read/post/search by a non-member, editing another user's message, member creating an app
  • Listening ports of the embedded Postgres
  • Slack: public pricing, feature and compliance pages only; no Slack systems probed
  • 0 critical, 5 high in npm audit, all in dev-only tooling (braces via eslint-config-next); 0 in production dependencies.
  • No secrets in git history or tracked files.
  • No security headers set (no CSP, no clickjacking protection, no HSTS, no nosniff); X-Powered-By is sent. Fixable in next.config.ts, but not done.
  • Auth held up: 403 for uninvited emails, lockout after 5 wrong codes, 401 for forged tokens and for bot tokens on the user API, session gone after logout. Row-level security kept a private channel's messages from a non-member in read, post and search.
  • Embedded Postgres listens on localhost only (default password postgres, so do not expose that port).
  • Code review: in dev mode the sign-in code is returned to requests whose Host header looks local; since dev mode is the only working mode today, a public deploy behind a proxy that forwards Host needs care. Not exploited.
  • No email delivery, so codes are printed in the server log; anyone with log access can sign in as any invited user.

Own business

Total / mo
$24.00
Hosting / mo
$24.00

Your messages and files stay in your own Postgres. No vendor certifications: you rely on the open code and your own server hygiene (add security headers, TLS, backups).

None on price (MIT). Host prices can change; DigitalOcean list read 2026-10-21.

Math: $24/mo flat vs Slack Pro $8.75 × seats. 5 people: $24 vs $43.75. 10 people: $24 vs $87.50 ($762/yr saved in cash). Not counted: fixing the production build, adding email, and your admin time (not measured). If Slack Free's 90-day history is enough for you, Slack is $0.

Sell @ 10 customers

Hosting / mo
$24.00

Hosting it for 10 customers means fixing the production build, adding an email provider, security headers, TLS, backups and monitoring first. It already supports several workspaces in one deploy (measured in the smoke test).

Low on software (MIT). Your costs are server size and email volume.

Hosting estimate $24–48/mo depending on load. Support hours and the build fix are real costs we did not measure, so none are priced here.

Sell @ 100 customers

Hosting / mo
$48.00

At 100 customers buyers ask for SOC 2 or ISO 27001 evidence, SSO, data export, an SLA and a security contact. The project has none of these; Slack lists SOC 2 Type II and ISO/IEC 27001 on its compliance page.

Single builder, 0 stars and 1 contributor on 2026-10-21, no commits since 2026-10-12: plan to own the fork.

$48/mo is the 8 GiB DigitalOcean list price as a starting point, not load-tested at this scale. Multi-server real-time (one LISTEN connection per app process) not tested. Slack Pro list: $8.75 × 100 = $875/mo.

Reproducible setup

  • git clone https://github.com/guillaumeduhan/free-slack-clone && git checkout fe9e13bb5e0e8a17f0305035e8562afa2dbcb885
  • Use Node.js 22+ (node -v)
  • npm install (or npm ci for the exact lockfile)
  • npm run dev (embedded Postgres on 127.0.0.1:54329, migrations, seed, app on :3002)
  • npm run smoke (49 checks)
  • Our core flow: python3 core_flow.py against http://localhost:3002 (27 steps; dev_code sign-in)
  • Burst: 10/50/100 concurrent POST /api/conversations/:id/messages and GET …/messages, then count stored messages
  • npm audit --json and npm audit --omit=dev --json; gitleaks git . and gitleaks dir .
  • curl -sD - http://localhost:3002/login for headers
  • DATABASE_URL=postgres://postgres:postgres@localhost:54329/chat npm run build (fails at /invite/[token])

Repo: https://github.com/guillaumeduhan/free-slack-clone

License: MIT

Sources

Disclosure

Verification: Partially Verified. Bot2Bot Labs. Nobody paid for this test. Test cost $0: local run on our own box with free tools, no paid services, no accounts. No relationship with Guillaume Duhan, Slack/Salesforce or DigitalOcean (DigitalOcean prices are used only as a public reference point, no affiliate link). We did not use, log in to or probe Slack; Slack facts come from its public pages.

Run-side numbers (setup, smoke, core flow, burst, memory, audit, secrets, headers, auth, production build) are measured by us on 2026-10-21 in dev mode, the only mode that runs at this commit. Build-side cost is not disclosed by the builder; time comes from git timestamps only. Hosting dollars are estimates from DigitalOcean list prices sized to our measured memory, not a real deploy. Feature checklist (24 items) built from Slack's public feature and pricing pages: present are channels (public/private), DMs and group DMs, threads, reactions, mentions, edit/delete, file sharing, search, real-time updates, unreads, saved items and drafts, roles and invites; partial: apps (bot token and webhooks, no marketplace); missing: huddles/video, clips, canvas, lists, Workflow Builder, Slack AI/Slackbot agent, Slack Connect, enterprise search, native apps and push, SSO, email notifications.

Get this receipt for your AI-built app — Receipt Scan $19 →

For AI and citation

Machine-readable summary and citation line for crawlers, assistants, and footnotes. Content is always in the page HTML.

Key facts, quotable summary, and how to cite

Download all receipts (JSON)

More receipts