The Slack app for security teams. PR alerts in the right channel, fix proposals threaded under the offending diff, slash commands for triage, approve-by-emoji workflows, and escalation that respects oncall. Every action is signed and audited.
The engineer is already in Slack. The reviewer is already in Slack. The platform meets them in the channel where the work is being discussed.
Every PR that fails a policy gate, introduces a reachable CVE, or breaks a license rule posts an inline thread in the right team channel. The thread carries the diff, the rule, and the suggested fix — not a one-line alert with a dashboard link.
/safeguard finding 1234, /safeguard scan owner/repo, /safeguard waive CVE-2025-XXXX — the common triage verbs are typeable from the message box, with rich confirmations rendered back in the channel.
Configure approval gates so that a configured reviewer can sign off with a reaction emoji — a tick for approve, a clock for defer, a flag for escalate. Reactions are validated against role, then logged as a signed approval.
If a critical finding isn't acknowledged inside the SLA window, the alert escalates up your configured oncall chain — DM, channel ping, then page. The chain is a config file, not a runbook engineers have to remember.
Type @safeguard search log4j and the bot replies with every product that ships a vulnerable build, the reachability verdict, and the open work. The conversation thread becomes a shared triage surface.
Every alert, every approval, every slash command is logged with the Slack user, the workspace, the channel, and the resulting platform action. Slack is a frontend, not a back door.
Workspace admin grants the OAuth scopes. The bot user joins the channels you nominate; nothing else.
Tell the bot which channel owns which product or repo. Alerts route to the right room — not a noisy firehose.
Pick which Slack users (or user groups) can sign off on which gate types. Roles are pulled from your existing Slack group memberships, with overrides for sensitive gates.
Connect your PagerDuty, Opsgenie, or Incident.io rotation so escalation chains follow the people who are actually awake.
Alerts land in the right room, the right person approves with a reaction, and the platform's state changes accordingly. No new dashboard for the team to learn.
One OAuth flow, one channel mapping, and the next merge with a reachable CVE shows up in #platform-security with the fix attached.