Integrations

Findings that never reach engineering do not get fixed. Integrations exist so that remediation work lands in the tools teams already use, while the security record stays intact on the platform.

Supported destinations

System	Typical use
Jira	Issue tracking for remediation work, including projects with existing security workflows
GitHub	Issues and pull requests, so fixes and findings reference each other
GitLab	Issues and merge requests in GitLab-managed delivery
Azure DevOps	Work items in Azure Boards
Slack	Channel notifications for new findings, state changes and SLA breaches
Microsoft Teams	Channel and chat notifications where Teams is the collaboration layer

What syncs

The integration carries the finding, not the whole program:

Finding summary — title, severity, affected asset and current state.
Reproduction and evidence references — linked to the platform record rather than duplicated into a ticket body, so evidence stays under the platform's access control.
Ownership and deadlines — pushed into the destination so engineering plans the work where planning happens.
State changes in both directions — a resolved ticket can move the finding to remediation-complete, and a retest result remains the platform's record.

What stays on the platform

Some things deliberately do not travel:

Researcher identity — engineer-facing tickets can withhold reporter details, depending on program configuration.
Raw evidence files — referenced by link; downloads are authorised by the platform, which keeps the access rules in one place.
Reward and payment data — never sent to engineering systems.
Disclosure state — governed by the program's disclosure policy, not by a ticket status.

Notification behaviour

Slack and Teams integrations are notification channels rather than systems of record:

Configurable per program and per severity, so a critical finding and a low-severity one need not interrupt the same people.
State-change notifications so reviewers do not have to poll a dashboard.
SLA warnings routed to the program owner rather than broadcast, keeping noise proportionate.

Setting up an integration

Decide the destination project or repository and confirm the platform account can create items there.
Grant the integration only the scopes it needs — issue creation and state read, not repository administration.
Map severity to priority in the destination once, so every finding lands with sensible priority.
Choose the bidirectional fields — which state changes move back to the platform.
Test with a single non-production finding before enabling the integration across a live program.

Availability and limits

Jira, GitHub, GitLab, Azure DevOps, Slack and Teams integrations are available on plans where integrations are enabled; the number of concurrent connections may depend on plan.
Field mapping depth, bidirectional state sync and historical analytics around integration throughput are Professional-tier and above.
Integration credentials are stored as secrets and are not returned by the API.

Remediation and verification — the lifecycle the integrations feed
Triage pipeline — states that sync back onto the finding
Platform overview — how the platform's parts fit together