Slack
The Slack integration posts to one channel in your Slack workspace:
- Urgent alerts when a pull-request scan finds a new finding at or above the severity you choose.
- A digest of your open Critical and High findings, on a schedule you choose.
Messages include finding titles, severities, repositories and links to the findings and pull requests. They never include code, finding descriptions or evidence. Everyone in the channel can see them.
Connecting your workspace
An organisation admin connects Slack from Settings → Notifications:
- Click Add to Slack and approve the Dam Secure app in your workspace. The app asks to send messages and to see your channel names, nothing else.
- Pick the channel to post to. Alerts and digests both post there.
- Click Send a test to check a message arrives.
Private channels
Slack only shows a private channel to the app once the app is in it. In the private channel, run:
/invite @Dam Secure
Then click Refresh in the channel picker and pick the channel. Public channels need no invite.
Choosing what to send
The What to send card controls both kinds of message. Tick Urgent alerts, Digest or both.
Urgent alerts. Use Alert on to choose how severe a new finding must be: Critical only, High and above, or Medium and above. Dam Secure sends at most one alert an hour. Alerts never use @channel.
Digest. Choose how often it goes out (daily, every weekday or weekly), the day, the time and the timezone. The digest counts your open Critical and High findings, lists the first few at each severity with a link to the rest, and marks the ones that are new since the last digest. If nothing Critical or High is open, no digest is sent. If your organisation has dependency scanning, the digest counts and lists dependency issues too, with separate links to code issues and dependency issues.
While nothing changes, the digest comes less often. If the counts are the same and nothing is new, the same digest goes out again a week after the last one, then a month after that, then every three months. Any change, including a finding being fixed, sends the digest at the next scheduled time and starts over.
The timezone is saved for your whole organisation, so everyone sees the same schedule.
Only organisation admins can change these settings. Everyone else sees them read-only.
Turning it off and disconnecting
Use the switch on the Slack card to pause everything without losing your settings. Untick Urgent alerts or Digest to stop just one of them.
Click Disconnect to remove the connection. Your settings are kept if you reconnect.
If Slack stops accepting the connection, for example because the app was removed from the workspace, the card shows Expired. Nothing is sent until an admin clicks Reconnect. Alerts and digests missed in the meantime are not sent later.