Slack Integration
Receive durable security scan notifications directly in your Slack channels.
Setup
- In Slack, create an Incoming Webhook for the destination channel.
- In CodeStax, open Dashboard → Integrations → Slack.
- Paste the webhook URL and select Test Connection.
- Select Save & Connect only after the live test succeeds.
CodeStax accepts only HTTPS webhook URLs on hooks.slack.com and
hooks.slack-gov.com. Redirects and environment proxies are disabled, and the
resolved public address is pinned for each outbound request.
Notification Types
| Notification | Description |
|---|---|
| Scan Complete | When a scan finishes (with summary: issues found, severity breakdown) |
| Critical Vulnerabilities | Immediate alert when critical-severity issues are found |
| Known-exploited vulnerability | When a scan identifies a KEV-listed dependency |
| Policy violation | When an organization dependency policy is violated |
Delivery guarantees
Webhook URLs are encrypted at rest and never returned to the browser. A masked configured state lets administrators replace a URL without exposing the saved credential.
Scan-completion deliveries use a stable delivery identity and persistent audit record. Scheduler overlap or an API restart therefore cannot post the same completed scan twice after Slack has accepted it.
Repository-specific mappings are available through POST /api/settings/slack.
Every mapped repository is checked against the authenticated organization
before any configuration is changed.
Plan Availability
| Plan | Slack Integration |
|---|---|
| Free | — |
| Growth | Available |
| Pro | Available |
| Enterprise | Available |