I'd be surprised if they don't have additional security. Here's some info on what Box did to add authentication and authorization to Hubot commands.

https://cloud.app.box.com/dodatx2015