Open Integrations in the portal (owners and admins).
Alert destinations
Generic signed webhooks, Slack, Microsoft Teams and PagerDuty. Confirm a destination with Send test, which sends a real message to your own workspace or service.
Jira Cloud and GitHub issue destinations open one issue per finding or monitoring problem. A later occurrence adds a comment and a recovery closes the issue. Send test creates a [TEST] issue and closes it. Evidence and scan credentials are never copied into an issue.
SMS texts critical and high alerts (title and severity only) to a phone number you verify with a one-time code. It appears only when your plan includes it and the platform has connected an SMS provider. Reply STOP to switch it off.
API tokens
Create a token with a name, scopes and an expiry of up to one year, and enter your current authenticator code. The token is shown once: copy it then. Send it as Authorization: Bearer <token>. A token can never do more than your own role, works for one organization only, and cannot manage members, sessions, billing or webhooks. Revoke it from the same page at any time.
Webhooks
Add an HTTPS endpoint, choose events and copy the signing secret (shown once). A test ping is sent automatically and the endpoint stays disabled until it answers with a 2xx status. Rotating a secret keeps the old one valid for one day. The page lists recent deliveries with status and latency and lets you resend one.
Failed deliveries are retried with growing delays (30 seconds, 2 minutes, 10 minutes, 30 minutes, 2 hours, 6 hours, 12 hours). An endpoint that keeps failing for over 24 hours is disabled and the owners are emailed. To check deliveries, see Verify webhook signatures.