Notifications & integrations

CBX Guard moves change in two directions, and it helps to keep them straight:

• Changes come in through the gate. Your GitLab and GitHub connections are how a change reaches CBX Guard to be reviewed — the pull request is the doorway. See Connect a repository.
• Verdicts go out through notifications. Once a change is judged, the verdict needs to land somewhere a human will see it. That's what this page is about: Slack and email.

Never silent on real risk

Silence in CBX Guard is meaningful — it means provably fine. For that to be trustworthy, a real finding must always reach you. So the notification channels are built around a never-silent model: a tier-one alert always has a delivery path, and a periodic proof-of-life heartbeat confirms the path itself is alive even when there's nothing to report.

• Slack is the primary delivery path — verdicts post straight to the channel where your team already works.
• Email is the fallback. Tier-one alerts and the proof-of-life heartbeat also email your recipients, so the never-silent guarantee survives a Slack outage.

Connect Slack first; add email so a single broken channel can never swallow a real verdict. You'll find both under Integrations in the Console.

Connecting Slack

Verdicts post to your Slack channel through a Slack Incoming Webhook — a per-channel URL Slack gives you that CBX Guard posts messages to. You create the webhook in Slack, then paste its URL into the Console. CBX Guard never needs broad workspace access; it only holds the one webhook URL you give it.

Step 1 — Create the Slack app and webhook

You need a small Slack app that owns the Incoming Webhook. The fastest way is to create it from a manifest — one paste pre-configures everything CBX Guard needs.

Recommended — Create from an app manifest

1. Go to api.slack.com/apps and click Create New App.
2. Choose From an app manifest.
3. Pick the workspace that owns the channel you want verdicts in, then click Next.
4. Paste the manifest below (replacing the example), confirm it on the review screen, and click Create.

display_information:
  name: CBX Guard
  description: Posts CBX Guard merge verdicts to your channel.
  background_color: "#0b3b3b"
features:
  bot_user:
    display_name: cbx-guard
    always_online: true
oauth_config:
  scopes:
    bot:
      - incoming-webhook
      - chat:write
settings:
  incoming_webhooks:
    incoming_webhooks_enabled: true
  org_deploy_enabled: false
  socket_mode_enabled: false
  token_rotation_enabled: false

5. On the app's Basic Information page, click Install to Workspace (under Install your app) and approve the prompt.
6. Open Incoming Webhooks in the left sidebar and click Add New Webhook to Workspace.
7. Choose the channel that should receive verdicts and click Allow. For an incoming webhook, picking the channel here is the install step — the webhook is bound to that one channel.
8. Copy the generated Webhook URL — it looks like https://hooks.slack.com/services/T…/B…/…. Keep it handy for Step 2.

Or, manually

Prefer to click through it yourself? You can skip the manifest:

1. Go to api.slack.com/messaging/webhooks and follow Slack's flow to create (or reuse) an app for your workspace.
2. Enable Incoming Webhooks, then click Add New Webhook to Workspace.
3. Pick the channel that should receive verdicts and click Allow.
4. Copy the generated webhook URL — it looks like https://hooks.slack.com/services/T…/B…/….

Step 2 — Connect it in CBX Guard

1. In the Console, open Integrations and click Connect Slack on the Slack card.
2. Paste the Webhook URL.
3. Optionally add a Channel label (e.g. #platform-alerts) — a human-readable name shown in the Console so it's clear where verdicts are going. If you leave it blank, CBX Guard just shows your workspace default.
4. Click Connect Slack.

The Console stores only the webhook URL and shows it masked (the last few characters only), so it's recognizable without being exposed.

Step 3 — Send a test

Click Send test message on the connected Slack card. CBX Guard posts a confirmation message to the channel so you can verify the path end-to-end before the first real verdict arrives. If Slack rejects the webhook, the Console tells you so you can fix the URL.

Email fallback

Email is the safety net behind Slack. Tier-one alerts and the proof-of-life heartbeat are delivered to your email recipients too, so even if Slack is down — or never connected — a real verdict still lands.

1. In Integrations, click Add recipients on the Email fallback card.
2. Add one or more addresses (e.g. security@example.com). Add as many as you like; remove any with a click.
3. Click Save recipients.
4. Use Send test email to confirm delivery to every address on the list.

Come back any time via Manage recipients to add or remove addresses.

Where each verdict goes

See Getting started and Concepts for what each tier means.

The gate is the other direction

Slack and email are where verdicts go. The VCS and CI connection is how changes come in — your GitLab and GitHub repositories are the doorway CBX Guard reviews before a change lands. If you haven't wired that up yet, start there:

Next steps