Destinations and per-destination severity thresholds

The four destination types

Email renders as HTML with a short table of the essentials — rule, severity, affected object and first-seen time — plus the remediation SQL where one exists. Email is part of every plan, including Free, and needs no configuration beyond an address.

Slack messages are built as Block Kit attachments with plain-text fallbacks, so they survive skimming in a busy channel: headline first, then fields for rule, severity and table, then the remediation SQL in a fenced block. Slack arrives from the Indie plan upward.

Discord messages render as embeds within Discord’s documented length ceilings, colour-coded by severity. Discord and custom webhooks are included on the Team plan.

The generic webhook posts a JSON document describing the event, suitable for anything that accepts HTTP POSTs — an internal bot, an incident platform, a serverless function. Delivery paths return outcomes rather than throwing: one broken endpoint records its failure and lets the others succeed, and each attempt is written down before anything else happens, which is what makes retries safe to repeat. The payload uses snake_case field names as its wire contract:

{
  "event": "security.finding.new",
  "project": { "id": "…", "name": "acme-web", "ref": "abcdefghijklmnopqrst" },
  "finding": {
    "rule_id": "RLS_DISABLED",
    "severity": "critical",
    "table": "public.invoices",
    "title": "Row Level Security is disabled on public.invoices",
    "remediation_sql": "alter table public.invoices enable row level security;",
    "first_seen_at": "2026-08-23T09:14:00Z"
  },
  "dashboard_url": "https://rowshield.dev/projects/…",
  "timestamp": "2026-08-23T09:14:02Z"
}

Per-destination severity thresholds

Every destination carries its own minimum severity. A pager channel can take critical findings only while an operations room receives everything, fed from the same scan. When an event sits below a destination’s threshold, nothing is sent to it, and the skip is recorded — the delivery log shows that the event was evaluated and filtered, which matters when someone asks why the channel stayed quiet.

Thresholds are independent per destination, so changing the Slack room’s appetite never moves the webhook’s. They apply to every event type alike, including resolutions, so a critical-only pager is not woken by a table becoming quiet again unless you ask it to be. The threshold belongs to the destination itself rather than to any rule, so tuning volume is one decision per room instead of one per finding type. Severity levels themselves are explained in the findings section; critical covers rules such as RLS_DISABLED and SERVICE_ROLE_KEY_EXPOSED.

Delivery paths are also isolated from one another: one broken Slack webhook does not stop the email going out. Each destination returns its own outcome, success or failure, and failures are visible rather than swallowed.

Which channels each plan includes

Availability follows the plan: email everywhere; Slack from Indie upward; Discord embeds and custom webhooks on Team. Attempting to add a destination your plan does not include returns a clear message naming the cheapest plan that would allow it — the interface never silently drops a channel you asked for.

Whatever the mix, sensitive content stays out of the message body by design. Exposed data appears as column names and counts, discovered keys as fingerprints rather than values, webhook URLs are stored masked, and network failures resolve to fixed phrases instead of raw responses. An embed screenshot shared around a server leaks none of your data.

Related questions

Can I send the same alert to Slack and email at different thresholds?

Yes, that is what per-destination thresholds are for. Email might receive everything while the Slack room filters to critical and high; each destination evaluates the event independently.

What does the webhook receive for a resolved finding?

The same JSON envelope with the event set to security.finding.resolved. The remediation_sql field is omitted, because there is nothing left to apply.