Skip to main content
Monitored repos scan themselves on every push — notifications close the loop by telling you when one of those scans found something new, so nobody has to keep a dashboard open.

​
What triggers a notification

All three conditions must hold:
  1. The scan was automatic (push-triggered on a monitored repo). Manual scans never notify — you’re already looking at the result.
  2. The scan surfaced at least one new finding, per cross-scan diffing. Re-detections of known findings stay quiet, so a busy repo doesn’t spam the channel on every push.
  3. Notifications are configured and enabled in Settings.
The message names the repo and branch, counts the new findings, summarizes the current open-findings posture, and links to the repository page in Pipefort.

​
Setup

  1. In Slack, create an incoming webhook for the channel that should receive alerts (see Slack’s guide).
  2. In Pipefort, open Settings in the sidebar, paste the webhook URL into the Notifications card, and Save.
  3. Click Send test — a confirmation message should appear in the channel.
Use the toggle to pause notifications without deleting the webhook, or Remove to delete the configuration entirely.
Only https://hooks.slack.com/… URLs are accepted. Pipefort’s server delivers these messages itself, so it restricts destinations to Slack rather than posting to arbitrary user-supplied URLs. Slack-compatible endpoints (e.g. Mattermost) are a planned follow-up.

​
Semantics worth knowing

  • Notifications are per user: when a monitored repo’s automatic scan finds new issues, every member of that organization with notifications configured gets the message on their own webhook — each member’s settings decide whether (and where) they’re notified.
  • Delivery is best-effort: a Slack outage never fails or delays the scan itself. Failed deliveries are logged server-side and not retried.
  • The webhook URL is stored for your account and treated as a secret — it is never included in server logs.