Point FlawPilot at your own endpoints and it posts a signed event the moment something happens - a website or code scan finishes or fails, a pentest changes status, a schedule is paused, a badge moves. Your ticketing, chat-ops, or data pipeline hears about it at once, without polling an API.
Requires a free account and the Owner or Admin role in your space. Find it in the dashboard under Settings → Webhooks.
Every attempt logged for 30 days. Resend anything that failed.
Each endpoint picks its own events - website scans, code scans, Site Health, pentests, scheduled runs, badge changes - or takes every event, including ones added later.
Send one project's events to one team's endpoint and another project's elsewhere. Leave the filter empty and an endpoint hears about every project in the space.
Every request carries a signature that follows the open Standard Webhooks spec, so you can verify it with an existing library. Rotate the secret with a 24-hour overlap and no downtime.
A failed delivery retries on its own for about 21 hours. Every attempt is logged for 30 days, and anything that never arrived can be resent in one click.
Add an endpoint once. After that, FlawPilot handles sending, retrying, and logging.
Give FlawPilot an https URL and, if your receiver needs it, custom headers such as an Authorization token. You get a signing secret once, at creation, to store on your side.
New endpoint
URL
https://hooks.example.com/flawpilot
Signing secret
whsec_MfKQ9r…a1B2
Store this now. You will not see it again.
Tick the events this endpoint should receive and, optionally, the projects it covers. Choose a detailed payload with the most severe findings, or a summary with scores and counts only.
Events
Website scan
Code scan
Badge
Each request carries webhook-id, webhook-timestamp, and webhook-signature headers. Verify them with any Standard Webhooks library, and use the id to ignore a repeat delivery.
webhook-id: 01929a6e-7c1f…
webhook-timestamp: 1792404000
webhook-signature: v1,K3rQ9xT2…
import { Webhook } from 'standardwebhooks';
const event = new Webhook(secret).verify(body, headers);
Signature valid
The delivery log shows each event, the status code your receiver returned, and every retry. Send a test ping before you go live, and resend anything that failed while your endpoint was down.
Every attempt logged for 30 days. Resend anything that failed.
One event per thing that happens, named so a receiver can route on the type alone.
| Event | When it fires |
|---|---|
| quick_scan.completed / quick_scan.failed | A website scan finished, including partial results, or failed. |
| code_scan.completed / code_scan.failed | A code scan run finished, or every dimension of it failed. |
| site_health.completed / site_health.failed | A Site Health crawl finished, failed, or timed out. |
| pentest.in_progress / completed / rejected | A pentest request started, was completed, or was rejected. |
| schedule.run_failed / run_skipped / paused | A scheduled run failed or was skipped, or the schedule was paused automatically. |
| badge.updated | A site's badge score or pillar changed. |
| integration.disconnected | A connected GitHub or GitLab account stopped working, so its code scans stop until you reconnect it. |
Pentest and integration events are not tied to a project, so they reach only endpoints without a project filter.
Both tell you something happened. One is written for people, the other for software, and most teams end up wanting both.
| Team notifications | Webhooks | |
|---|---|---|
| Who reads it | People, in Slack, Teams, Google Chat, or email | Your own code, at a URL you control |
| What arrives | A short message with a link to the report | A signed JSON payload with scores, counts, and findings |
| Good for | Telling the team a score dropped | Opening a ticket, failing a release, or feeding a data warehouse |
| If it fails | The message is missed | Retried automatically, logged, and resendable |
Team notifications are on the roadmap too. Webhooks are for when the next step is automated rather than read.
See the full roadmapGet started
Add an endpoint, send a test ping, and FlawPilot takes care of signing, retrying, and logging every event after that.
