Notifications
The notification settings in StepSecurity send alerts about critical security events to email, Slack, or Microsoft Teams. These notifications help you stay informed about potential security risks in your workflows.
Notifications are organized into notification profiles. Each profile sends the events selected on it to its own destinations, so you can route different events to different teams or channels.
Accessing notification settings
In the StepSecurity app, go to Settings → Notifications.
Notification profiles
The Notification Profiles page lists every profile in your organization. Each profile card shows its configured destinations and the events selected on it. Click a profile card to expand it and edit its settings.
Default profile
Every organization has a Default profile. The default profile can hold email, Slack, and Microsoft Teams destinations at the same time.
Adding a profile
Click Add Notification Profile.
Select the profile type: Email, Slack, or Microsoft Teams.
Expand the new profile. It shows Not configured and No events selected until you add a destination and select events.
Enter a Name for the profile. The name defaults to the profile type.
Enter the destination for the profile type. See Destinations.
Select the events this profile sends. See Notification Events.
Click Save.
Deleting a profile
To remove a profile you added, click the delete icon on its card.
Destinations
Enter one or more email addresses, separated by commas, up to a maximum of 49 addresses. Every address receives the events selected on the profile.
Slack
In the default profile, you can set up Slack notifications in one of two ways:
Webhook URL:
Provide your Slack webhook URL. Follow these instructions to create a Slack webhook.
OAuth App:
Configure the Slack App in your Admin Settings to enable OAuth-based notifications.
Follow this interactive demo to see how to setup Slack OAuth App:
Microsoft Teams
To integrate with Microsoft Teams, add a Teams webhook URL. Follow these instructions to create a Teams webhook.
Notification Events
Each profile has its own list of events. Select the events that send a notification to that profile's destinations. Events are grouped below by the product area that raises them.
Harden-Runner runtime detections
These events fire when Harden-Runner detects suspicious behavior during a workflow run. Each one corresponds to a detection type described in Detections.
Outbound traffic is blocked
Anomalous outbound call is discovered
Anomalous HTTPS outbound call is discovered
Source code file is overwritten
Secrets are detected in the build log
Secrets are detected in the build artifacts
Imposter commits are detected
A secret exfiltration attempt is detected
Suspicious network calls are detected
Suspicious process events are detected
Non-compliant artifacts are detected
GitHub Checks results
These events fire when a StepSecurity check fails on a pull request. See GitHub Checks for the difference between the three check types.
Baseline check failures are detected, for the Harden-Runner Baseline Check
Required check failures are detected, for StepSecurity Required Checks, which block merges on failure
Optional check failures are detected, for StepSecurity Optional Checks, which are advisory only
Workflow run policies
A run policy is blocked, when a workflow run is blocked by a policy. See Workflow Run Policies.
Threat intelligence
StepSecurity threat intel flags a compromised component
Threat intel notifications cover the incidents surfaced in the Threat Center. When you enable this event, the current granularity setting appears beneath it. Click it to open the Threat intel notifications dialog and choose when your organization is notified:
All threat intel incidents
Notify about every threat intel incident, whether or not your organization is affected.
Affected packages
Notify only when your organization is affected by a compromised package, matched by name, at any version.
Exact version only
Notify only when your organization uses the exact compromised version.
Choose All threat intel incidents if your security team tracks ecosystem-wide threats regardless of exposure. Choose Affected packages or Exact version only to narrow alerts to incidents that touch your own dependencies, with Exact version only producing the smallest set of alerts.
Click Done to confirm your selection.
PAT Governance
These events fire when a personal access token violates your PAT Governance policy, or is nearing expiration. Configure the underlying thresholds (max age, over-scoped scopes, idle window, reminder bands) under Settings > Control Evaluation.
A token exceeds its maximum age - The token is older than the configured maximum age for its class (fine-grained and classic tokens have separate limits).
A token has no expiration, or one beyond the allowed lifetime - The token was created with no expiration, or with an expiration further out than the configured maximum age allows.
An over-scoped token is detected - A classic token carries a coarse scope such as repo, admin:org, or workflow, or a fine-grained token combines all-repository access with a write-level permission.
A token sits unused past the idle limit - The token shows no use for longer than the configured idle window. A never-used token is measured from when it was granted or authorized.
A token is nearing expiration - Sends a reminder before a token's expiration date. Bands default to 30, 7, and 1 days out, and can be set per token class. You can also CC additional addresses on every reminder and customize the subject and body of each reminder email. All of these are configured under Control Evaluation.
File Exclusions
If there are specific files you do not want to trigger notifications (e.g., README.md, package-lock.json), you can list them in the Exempt Files text box. Wildcards (e.g., *.md) are supported.
Saving Your Preferences
Once you've configured the notification settings, click Save to apply your changes.
Last updated
Was this helpful?