Fitting in
Notifications
Slack, Teams, mail and a plain webhook, on what is new rather than on the standing backlog.
New findings only
A nightly message about the backlog trains people to filter the sender, which is worse than sending nothing. Every finding carries when it was first seen, so this is already answerable.
Routed by severity
Three things go out on their own the moment they are found: a credential the provider confirmed still works, a vulnerability on the exploited list, and a malicious package. Everything else above the floor is one digest at the end of the scan.
Mail two ways
SMTP, with the username and password both optional because an internal relay that accepts mail from this host by address wants neither. Or Microsoft 365 through the Graph API, for tenants with basic authentication switched off, which have no SMTP left to offer.
Never the secret
A message carries the same redacted preview the report files do. It lands somewhere with a different set of readers than the web page has.
What it does not do
It notifies. It does not open the ticket, and Snyk does.
Every feature page carries one of those. The comparison page scores the same ground against five products people pay for, including the rows that go against us.