Loud when it matters, quiet otherwise.
A security tool that sends forty messages about one bad deploy trains people to mute it. Alerts here are grouped per site and per change, cooled down, and sent once; everything else waits for the digest.
One message per site per 30 minutes.
Only what a founder must hear about now goes out instantly. It is grouped per site and per change, lists at most 8 findings, names the push that introduced them, and then the site is quiet for 30 minutes however much else arrives.
- Slack, one webhook per organization
Paste an incoming-webhook URL, send a test message, and the alerts arrive where the team already is.
- Email, instant or digest
The same grouping by email, for anyone who set it up that way.
- Per-user on top of per-organization
Each person picks instant email, digest email and a minimum severity; the organization setting is the floor.
- Named after the cause
An alert says which change set introduced the finding, so the conversation starts at the right commit.
Daily or weekly, for the rest.
Everything that was not urgent is collected into a digest every 24 hours or every 7 days: what was found, what resolved, what changed on the site since the last one.
7 kinds, no more.
- Verify your addressEMAIL_VERIFICATION
- Reset a passwordPASSWORD_RESET
- Join an organizationTEAM_INVITATION
- Your free report is readyFREE_SCAN_REPORT
- Instant alertALERT_INSTANT
- Daily or weekly digestALERT_DIGEST
- A scheduled audit exportAUDIT_EXPORT
Every one of them is a template an operator can edit; none of them is marketing.
Any report, in the format the next person needs.
A client wants a PDF, a ticket wants Markdown, a spreadsheet wants CSV and a script wants JSON. Each export carries the same findings and none of them carries raw evidence; a secret that was masked in the app stays masked on paper.
- Spreadsheet-safe CSV
A cell that starts like a formula is neutralised, so a finding title cannot execute in someone’s spreadsheet.
- Bounded
A findings export stops at two thousand rows and says so, rather than timing out silently.
- Audited
Every export is written to the audit log with who asked for it and what it contained.
- PDF from the same page
The PDF is the report rendered by a real browser, not a second layout that drifts from the first.
Append-only, 400 days.
Every sensitive action - an invitation, a role change, a dismissal, a billing event, an export - is written down and cannot be edited afterwards. Owners and admins can read it, filter it and page through it.
- Scheduled exports
The trail can be exported on a schedule instead of pulled by hand.
- Streamed to a SIEM
Events can be streamed as they are written to a sink you configure, signed so the receiver can check them.
- Live progress
Scans stream their progress over server-sent events - to the free report page, to the app, and to a worker status view.
- Tenant-scoped
One organization’s trail is never readable from another, whatever the query.
Point it at a channel.
Create an account, paste a Slack webhook, and the next finding that matters arrives where the team will see it.