Alerts

Runs happen on a schedule; people do not watch them. Alerts post what a run found to a Slack channel — and only when there is something to say. A weekly change run that finds nothing stays quiet.

Set up

1. In Slack, add an Incoming Webhook to the channel that should receive alerts (Slack → Apps → Incoming Webhooks → Add to channel) and copy the URL.
2. In the workspace, open Settings → Alerts, paste the URL and press Send a test.

The URL is stored with the workspace and used for nothing else. Admins can change it; analysts and viewers can see that alerts are configured but not the URL.

What triggers an alert

Event	Default	Why
New critical or high findings, and findings whose severity rose	on	The reason to interrupt someone.
AI crawlers newly refused (or newly served); pages that stop returning 200	on	Usually a WAF rule or a deploy. The sooner known, the cheaper.
A run fails or pauses on its token budget	on	Someone has to resume it.
Findings resolved since the last run	off	Good news; turn on if the channel likes it.
Every completed run, even with nothing to report	off	A heartbeat.

Each alert names the site, lists up to five items with their severity, and links to the run. Findings are compared by their stable identity, so a finding that was already known does not alert again; only what is new, worse or gone does.

Email delivery and ticketing (Jira, Linear) arrive with the integrations phase.