Slack, Teams and webhook alerts

1. 1Open Team, then Integrations, and add Slack, Microsoft Teams or a webhook.
2. 2Pick which alerts it should receive, then click Send test to check the message arrives.
3. 3When a scheduled scan or a monitor finds something, Scanverra posts the alert as soon as the run finishes.

Scans someone runs by hand don't send alerts. Schedule the sites and repositories you want watched on the Scheduled scans page.

1. 1Read the raw request body exactly as it arrived, before any JSON parsing.
2. 2Compute HMAC-SHA256 of the timestamp header, a dot and the raw body, using the secret as the key.
3. 3Compare it with the signature header in constant time, and reject requests whose timestamp is more than 5 minutes old.

import crypto from "node:crypto";
import express from "express";

const SECRET = process.env.SCANVERRA_WEBHOOK_SECRET; // whsec_...
const app = express();

// express.raw keeps the exact bytes Scanverra signed.
app.post("/scanverra", express.raw({ type: "application/json" }), (req, res) => {
  const timestamp = req.get("X-Scanverra-Timestamp") ?? "";
  const signature = req.get("X-Scanverra-Signature") ?? "";
  const expected = "sha256=" + crypto
    .createHmac("sha256", SECRET)
    .update(`${timestamp}.${req.body}`)
    .digest("hex");

  const fresh = Math.abs(Date.now() / 1000 - Number(timestamp)) <= 300;
  const valid = signature.length === expected.length &&
    crypto.timingSafeEqual(Buffer.from(signature), Buffer.from(expected));
  if (!fresh || !valid) return res.sendStatus(401);

  const alert = JSON.parse(req.body);
  console.log(alert.event, alert.summary);
  res.sendStatus(204); // answer fast, do slow work afterwards
});

app.listen(3000);

Signing the timestamp with the body means a request someone captured can't be replayed later.

• Answer with any 2xx status within 5 seconds. Do slow work after you respond.
• Each alert is sent once and isn't retried. The Integrations panel shows whether the last delivery worked.
• Redirects aren't followed, so use the final URL.
• Only public HTTPS addresses are accepted. Slack URLs must be on hooks.slack.com, and Teams URLs on webhook.office.com or Power Automate.
• Alerts stop for the whole team if its Team or Enterprise plan lapses.