diff --git a/backend/windmill-api-workspaces/src/workspaces.rs b/backend/windmill-api-workspaces/src/workspaces.rs
index 7991284674..2b299c02f6 100644
--- a/backend/windmill-api-workspaces/src/workspaces.rs
+++ b/backend/windmill-api-workspaces/src/workspaces.rs
@@ -25,8 +25,8 @@ use regex::Regex;
 use hex;
 use sha2::{Digest, Sha256};
 use std::collections::{HashMap, HashSet};
+use strum::IntoEnumIterator;
 use uuid::Uuid;
-use strum::{IntoEnumIterator};
 use windmill_audit::audit_oss::{audit_log, AuditAuthorable};
 use windmill_audit::ActionKind;
 use windmill_common::db::UserDB;
@@ -39,7 +39,9 @@ use windmill_common::workspaces::GitRepositorySettings;
 #[cfg(feature = "enterprise")]
 use windmill_common::workspaces::WorkspaceDeploymentUISettings;
 use windmill_common::workspaces::{
-    check_user_against_rule, get_datatable_resource_from_db_unchecked, DataTable, DataTableCatalogResourceType, ProtectionRuleKind, ProtectionRules, ProtectionRuleset, RuleCheckResult, WorkspaceGitSyncSettings
+    check_user_against_rule, get_datatable_resource_from_db_unchecked, DataTable,
+    DataTableCatalogResourceType, ProtectionRuleKind, ProtectionRules, ProtectionRuleset,
+    RuleCheckResult, WorkspaceGitSyncSettings,
 };
 use windmill_common::workspaces::{Ducklake, DucklakeCatalogResourceType};
 use windmill_common::PgDatabase;
@@ -601,7 +603,10 @@ async fn get_settings(
 
     tx.commit().await?;
 
-    let settings = not_found_if_none(settings, "workspace settings", &w_id)?;
+    let mut settings = not_found_if_none(settings, "workspace settings", &w_id)?;
+    if !authed.is_admin {
+        settings.slack_oauth_client_secret = None;
+    }
     Ok(Json(settings))
 }
 
@@ -4369,9 +4374,13 @@ async fn list_protection_rules(
     Extension(db): Extension<DB>,
     Path(w_id): Path<String>,
 ) -> JsonResult<Vec<ProtectionRulesetResponse>> {
-    let rules =
-        (*windmill_common::workspaces::get_protection_rules(&w_id, &db).await?).clone();
-    Ok(Json(rules.into_iter().map(ProtectionRulesetResponse::from).collect()))
+    let rules = (*windmill_common::workspaces::get_protection_rules(&w_id, &db).await?).clone();
+    Ok(Json(
+        rules
+            .into_iter()
+            .map(ProtectionRulesetResponse::from)
+            .collect(),
+    ))
 }
 
 /// Create a new protection rule