Security findings that don't reach engineers in time aren't security findings — they're future incidents. This tutorial shows how to send PentestCheck scan alerts to the tools your team already uses.
Plan and permissions: alerts are available on the Pro and Enterprise plans. Only organization owners and admins can change the alert settings; other members can view them.
What Triggers an Alert
PentestCheck sends one alert when a scan finishes with new open findings at or above the severity threshold you choose. One threshold applies to every channel:
| Threshold | Alerts on |
|---|---|
| Critical only | Critical |
| High and above (default) | Critical, High |
| Medium and above | Critical, High, Medium |
| Low and above | Critical, High, Medium, Low |
Only findings that are new in that scan count: a finding an earlier scan already reported doesn't alert again. If a scan's new findings are all below your threshold, no alert is sent and the attempt is logged as Suppressed in the Alert History.
Where to Configure It
In the dashboard, open Settings → Security Alerts. There are two channels, and you can use both at once:
- Email Alerts
- Real-time Alerts (Slack, Discord, Telegram or a custom webhook)
Below them, Alert Threshold sets the minimum severity for both.
Slack and Discord
Paste the channel's incoming webhook URL:
- Slack: create an Incoming Webhook in your Slack app and paste its
https://hooks.slack.com/services/...URL. - Discord: in Server Settings → Integrations → Webhooks, create a webhook for the channel and paste its URL.
Telegram
Create a bot with @BotFather and paste its Bot Token. Then paste the Chat ID of the chat that should receive the alerts (@userinfobot can tell you yours).
Custom Webhook
Choose Custom Webhook and enter an Apprise-compatible URL. To reach your own HTTPS endpoint, use Apprise's jsons:// scheme: your server receives a JSON POST with the alert's title and message (format).
The URL must be a public internet endpoint. Private, loopback and cloud-metadata addresses are rejected.
Email Alerts
Turn on Email Alerts and add one or more addresses in To, plus optional CC addresses, separated by commas. Each alert email has the finding counts by severity, with a PDF report of the scan's new findings attached.
Send a Test Notification
Save your settings, then use Test. PentestCheck sends a test message to the webhook and a test email to the addresses you enabled, so you can confirm delivery before the next scan finishes.
What the Message Looks Like
Chat and webhook alerts are plain text, with counts only:
[PentestCheck] 3 finding(s) on app.example.com
Scan Job #482 completed for app.example.com (Acme Corp).
Findings: CRITICAL: 1, HIGH: 2
Review the full report in your PentestCheck dashboard.
The alert doesn't carry evidence, payloads or IP addresses. The details stay in the dashboard and in the PDF report.
Limits
- One chat or webhook destination per organization.
- One severity threshold, shared by email and webhook.
Avoiding Alert Fatigue
The most common alerting failure: every finding lands in the same busy channel, and within a week the channel is muted.
Rules for a sustainable setup:
- Start with the default High and above and send it to a channel your team actually monitors and treats as urgent.
- Lower the threshold only if that channel stays readable.
- Treat each alert as a call to act: a finding alerts only the first time a scan detects it, so track what's still open in the dashboard rather than waiting for a reminder.
- Check the Alert History (the last 20 dispatch attempts) when an alert seems to be missing: it shows which scans were alerted, suppressed or failed.
A security alert system that engineers ignore provides less value than no system at all.
Alerts are part of the Pro plan. See plans and pricing.