Point FlawPilot at your own endpoints and it posts a signed event the moment something happens - a website or code scan finishes or fails, a pentest changes status, a schedule is paused, a badge moves. Your ticketing, chat-ops, or data pipeline hears about it at once, without polling an API.
Run a scan nowIn development. Until it ships, the REST API returns the same results whenever you ask for them.
Every attempt logged for 30 days. Resend anything that failed.
Each endpoint picks its own events - website scans, code scans, Site Health, pentests, scheduled runs, badge changes - or takes every event, including ones added later.
Send one project's events to one team's endpoint and another project's elsewhere. Leave the filter empty and an endpoint hears about every project in the space.
Every request carries a signature that follows the open Standard Webhooks spec, so you can verify it with an existing library. Rotate the secret with a 24-hour overlap and no downtime.
A failed delivery retries on its own for about 21 hours. Every attempt is logged for 30 days, and anything that never arrived can be resent in one click.
Add an endpoint once. After that, FlawPilot handles sending, retrying, and logging.
Give FlawPilot an https URL and, if your receiver needs it, custom headers such as an Authorization token. You get a signing secret once, at creation, to store on your side.
New endpoint
URL
https://hooks.example.com/flawpilot
Signing secret
whsec_MfKQ9r…a1B2
Store this now. You will not see it again.
Tick the events this endpoint should receive and, optionally, the projects it covers. Choose a detailed payload with the most severe findings, or a summary with scores and counts only.
Events
Website scan
Code scan
Badge
Each request carries webhook-id, webhook-timestamp, and webhook-signature headers. Verify them with any Standard Webhooks library, and use the id to ignore a repeat delivery.
webhook-id: 01929a6e-7c1f…
webhook-timestamp: 1792404000
webhook-signature: v1,K3rQ9xT2…
import { Webhook } from 'standardwebhooks';
const event = new Webhook(secret).verify(body, headers);
Signature valid
The delivery log shows each event, the status code your receiver returned, and every retry. Send a test ping before you go live, and resend anything that failed while your endpoint was down.
Every attempt logged for 30 days. Resend anything that failed.
One event per thing that happens, named so a receiver can route on the type alone.
| Event | When it fires |
|---|---|
| scan.completed / scan.failed | A website scan finished, including partial results, or failed. |
| code_scan.completed / code_scan.failed | A code scan run finished, or every dimension of it failed. |
| site_health.completed / site_health.failed | A Site Health crawl finished, failed, or timed out. |
| pentest.in_progress / completed / rejected | A pentest request started, was completed, or was rejected. |
| schedule.run_failed / limit_reached / paused | A scheduled run failed or was skipped, or the schedule was paused automatically. |
| badge.updated | A project's security badge moved to a different band. |
Pentest events are not tied to a project, so they reach only endpoints without a project filter.
Both tell you something happened. One is written for people, the other for software, and most teams end up wanting both.
| Team notifications | Webhooks | |
|---|---|---|
| Who reads it | People, in Slack, Teams, Google Chat, or email | Your own code, at a URL you control |
| What arrives | A short message with a link to the report | A signed JSON payload with scores, counts, and findings |
| Good for | Telling the team a score dropped | Opening a ticket, failing a release, or feeding a data warehouse |
| If it fails | The message is missed | Retried automatically, logged, and resendable |
Team notifications are on the roadmap too. Webhooks are for when the next step is automated rather than read.
See the full roadmapWebhooks are not live yet, but you can already get FlawPilot's results into your own systems.
Trigger scans and fetch scores and findings over an authenticated HTTP API. It is the same data a webhook will push, fetched when you ask for it.
View API docsRun a scan on every pull request and fail the build on a regression. For release checks, this is the automation most teams want first.
See CI/CD scanningEmbed a badge in your README or site that always shows the latest score, with nothing to update by hand.
Get a badgeEarly access
One email when it is live, and nothing else. Join the waitlist and you get it before it is announced anywhere.
Waitlist members get first access and help decide which events and integrations ship first.
Not shipped yet
Webhooks are in development. Run a scan today, and pull the results through the REST API until events arrive on their own.
Run a free scan
