Send instant signed HMAC notifications to Slack, Discord, PagerDuty, and custom webhooks when incidents occur.
Dispatches payload events for scan.completed, scan.regression, uptime.down, and certificate.expiring with retry backoff and HMAC-SHA256 signatures.
Canonical test payload dispatched during security surface audits.
uptime.down event dispatched with signature header X-Scanlyst-SignatureWatch the probe engine test this signature in an isolated sandbox.
Webhook Signature Verification
const payload = req.body; // Unverified payload
const sig = req.headers['x-scanlyst-signature'];
const expected = crypto.createHmac('sha256', secret).update(rawBody).digest('hex');
if (sig !== expected) return res.status(401).send();Verify webhook signatures using HMAC-SHA256 to ensure incoming alert webhooks originated authentically from Scanlyst.
Copy and paste into your editor to refactor this issue automatically.
Test your public domain specifically for Incident & Outage Webhook Dispatcher.
Checks commonly evaluated alongside Incident & Outage Webhook Dispatcher during surface discovery.
Verify anti-CSRF tokens, SameSite cookie policies, and origin validation on sensitive state-changing routes.
Detect sensitive tokens, passwords, or PII stored in unencrypted localStorage or sessionStorage.
Detect web cache poisoning, password reset link poisoning, and server-side routing hijack via spoofed Host headers.
Audit your site across all 41 vectors automatically on every deploy.