Notifications and integrations

#Email and in-app alerts

DVSentry emails sign-up codes, password resets, invitations and account security alerts. In-app notifications appear under Alerts for everyone in the organization.

For scan and finding alerts, an Admin adds channels under Settings → Communications: an email address or a Slack incoming-webhook URL.

#Slack and Microsoft Teams app

Under Settings → Communications, an Admin installs the DVSentry app in Slack (exact scopes, no Enterprise Grid) or connects a Teams channel with a single-use code. Channels receive new or reopened findings, finished scans, cloud drift, new external assets, blocked release gates and Burnwatch alerts. Finding alerts have Acknowledge, Assign to me and Snooze 7 days; in a private chat /dvsentry status (Slack) or a message to the bot (Teams) shows your open findings. Each button press is re-checked (membership, role, repository visibility) before it acts.

While the Slack or Teams app is not set up, the page shows "not configured".

#Signed outbound webhooks

Settings → Integrations → Webhooks (Admin; where available). Pick a destination and events:

Events: scan.completed, finding.new, finding.reopened, drift.detected, easm.asset.new, gate.failed, cost.budget_threshold, cost.weekly_digest, cost.anomaly, advisory.matched, audit.*.

Each delivery is one envelope:

{
  "specversion": "dvsentry.event.v1",
  "id": "5d7b0f1e-...",            // stable: deduplicate on it
  "type": "finding.new",
  "occurred_at": "2026-11-01T10:15:00Z",
  "organization_id": "6b0d1c9e-...",
  "data": { "finding_state_id": "...", "title": "...", "severity": "HIGH", ... }
}

Headers: DVSentry-Event-Id, DVSentry-Event-Type and DVSentry-Signature: t=<unix seconds>,v1=<hex>, where v1 is HMAC-SHA256 of "<t>.<raw body>" with your whsec_... secret. During 24 hours after a secret rotation a second v1 carries the previous secret. Payloads never include finding descriptions or evidence. Verify in your receiver:

import hashlib, hmac, time

def verify(body: bytes, header: str, secret: str, tolerance: int = 300) -> bool:
    parts = [p.split("=", 1) for p in header.split(",")]
    timestamp = int(next(v for k, v in parts if k == "t"))
    if abs(time.time() - timestamp) > tolerance:
        return False
    expected = hmac.new(secret.encode(), f"{timestamp}.".encode() + body, hashlib.sha256).hexdigest()
    return any(hmac.compare_digest(expected, v) for k, v in parts if k == "v1")

Events are sent after a two-minute settle and retried up to 8 times.

#Issue trackers: Jira and GitHub Issues

Settings → Integrations → Issue trackers (where available). One encrypted connection per provider. DVSentry opens one ticket per finding that matches your rules, updates it when the finding changes, and records the link only after the tracker accepts it. Descriptions are never sent.

#GitHub

The GitHub App scans pushes and pull requests and posts a check.

#API, CLI, CI and IDE

• API, tokens and service accounts
• The dvsentry.py command-line client
• CI pipelines
• The VS Code extension shows a repository's open findings in your editor with a read-only token (CLI page).

#Feature capabilities

GET /v1/organizations/{id}/integrations/capabilities (scope org:read) tells a client which optional features are on for your organization. The web app checks it before showing a panel.

Something missing or unclear? Tell us with Feedback in the app.