WEBHOOKS & NOTIFICATIONS
Push events to your own systems as they happen, and tune the email you get so a critical finding is loud and a routine scan is quiet.
Webhooks
Settings → Webhooks → Add webhook. Enter an HTTPS URL and select the events to subscribe to. Webhooks can be paused, edited, or deleted from the same table.
| Event | Fires when |
|---|---|
scan.queued |
A scan is created and waiting to start. |
scan.started |
The engine begins crawling. |
scan.completed |
Scan finished and reviewed. |
scan.failed |
Scan stopped before finishing. |
finding.new |
A new finding is recorded. |
finding.critical |
A finding with severity critical is recorded. |
finding.statusChanged |
A finding’s status changed (fixed, false positive, re-opened). |
team.memberAdded |
A member joined the organization. |
Events are delivered as POST requests with a JSON body describing the scan or finding, including its ID, target, severity, and status.
Email notifications
Settings → Notifications. Toggles and their defaults:
| Notification | Default |
|---|---|
| Critical finding discovered | On |
| High finding discovered | On |
| Scan completed | On |
| Scan failed | On |
| New vulnerability advisories / CVE alerts | On |
| Weekly security digest | Off |
| Monthly compliance report | Off |
| Team activity | Off |
Separately from these toggles, you always receive an email when the on-call review of a scan finishes, because that is the moment findings become final.
Scan-level notification options
The New Scan wizard has On completion and On critical finding checkboxes. Today, delivery is governed by the account-level settings above; use those to control what arrives.
COMMON QUESTIONS
SEE IT ON YOUR OWN APP
Docs explain the product. A scan shows you what it finds on your deployed URL — keys, RLS, auth, and API gaps in under 60 seconds.
14-day free trial · No credit card · Cancel anytime
