Alerts by e-mail

Under Alerts, choose who receives the workspace’s alerts, by e-mail or in Slack or Teams, and which ones.

• The owner’s address receives alerts from the start.
• Any other address must be confirmed: it receives a link, and nothing is sent to it before someone clicks the button on that page.
• For each address, choose everything (new vulnerabilities, digests, reminders) or exploited vulnerabilities and deadlines only.
• Under Settings, each address can also keep to some products (or all, future ones included), and set a severity threshold for new vulnerabilities (from medium, high or critical, say). Exploited vulnerabilities and the reporting deadlines are sent whatever their severity, since they start the Article 14 clock. A product no address follows still sends its exploited vulnerabilities to every address rather than to none. Deadline reminders and drills go to every address, whatever its products. A vulnerability whose severity is not known always passes the threshold. The new vulnerabilities an address does not receive stay in the app; they are not sent later. When a followed product is deleted, an address left with no product follows them all again.

Slack and Microsoft Teams

On paid plans, alerts can also go to a Slack or Microsoft Teams channel, with the same settings as an address (everything or exploited only, products, severity threshold).

1. Slack: at api.slack.com/apps, Create New App, then Incoming Webhooks, Activate, Add New Webhook to Workspace, choose the channel and copy the address (https://hooks.slack.com/services/…). Teams: in the channel, Workflows, choose the template Send webhook alerts to a channel (not the variants from specific people or from people in an org, which need a sign-in), then copy the address it gives.
2. Under Alerts, Add a Slack or Microsoft Teams channel: choose the service, paste the address, choose what it receives, then Connect. Provetry sends a test message: the channel is connected once that message has gone through.

The address is stored encrypted and only its last characters are shown. Whoever knows it can post in your channel: keep it like a password, and remove the channel here if it leaks. A channel that refuses messages (webhook deleted, channel archived) or fails five times in a row is paused, with the last error shown; Send a test starts it again. After a move to Free, channels stop receiving alerts until you choose a paid plan again; e-mail addresses still receive them.

What you receive

• On paid plans, an alert as soon as a new vulnerability or an exploitation is found in a supported release. New vulnerabilities published on OSV.dev are checked every hour against the packages of your supported releases, so one that affects you is usually announced within the hour (the system packages of a container image, such as Debian or Alpine ones, are checked daily). Since the lists of exploited vulnerabilities are reread every hour too, an exploitation of a vulnerability already found in your releases is usually announced within the hour (within six hours when only ENISA’s EUVD lists it). On Free, a weekly digest.
• Reminders before each deadline of an open reporting case.
• Your plan’s important events (start, renewal problems).

Alert and reminder e-mails are sent in the workspace language, chosen in Settings; e-mails about your own account use your own language.