We are reviewing a Slack application for approval. The application is reqesting scope chat:write.public which is described by Slack as "Send messages to channels @your_slack_app isn't a member of". If approved, would the app be able to read any message in any channel?
While both the name and text indicate that this is a write permission, I don't see any read messages permission in the request and I assume a bot can read its users' replies.
Correct, in a raw state, an app will only be able to view messages that are sent to it. For anything else, it will require additional read permissions. The chat:write.public
method applies only to public channels. With this scope an app and post to any public channel. To post into private channels the app/bot would need to be added into the channel as a member.