A useful security alert in chat says what was found, where, how severe it is, who owns it, and what to do next, with one link to the full record. If the reader has to open three tabs to understand it, the alert is too thin.
The five fields
Chat is a poor place to hold detail and a good place to start action. Keep the message short and put the evidence behind a link.
| Field | Example wording | Why it matters |
|---|---|---|
| What | New critical finding in a dependency | Sets the topic in a glance |
| Where | Repository and service name | Lets the owner recognise it |
| How bad | Severity, plus whether it is reachable or known exploited | Prevents false urgency |
| Who | Owning team, mentioned once | Gives the alert an owner |
| Next | Upgrade to a named fixed version, or open the fix pull request | Turns information into a task |
Add a link to the ticket or finding page last. Do not paste logs, stack traces or secrets into the channel.
A short example
All values are invented.
Critical finding, billing-service. A dependency has a remote code execution advisory. The vulnerable function is called from a public endpoint. Fixed in version 2.4.1. Owner: payments team. Ticket linked below.
That is five facts in four lines. A reader can decide in ten seconds whether it concerns them.
Choose what deserves a message
Not every finding should go to chat. A good rule is that a message must need a human decision soon. Weekly low severity counts belong in a digest. A new critical, reachable finding on an internet facing service belongs in a channel.
Link every alert to the ticket so replies do not become the only record. If a decision is made in a thread, copy it to the ticket.
Mistakes to avoid
- Mentioning an entire channel for every alert. People mute it.
- Repeating the same alert on every scan. See the guide on duplicate tickets.
- Showing a score with no context. A high score on unreachable code is a different message from a high score on an exposed path.
- Posting sensitive values. If a secret is pasted in chat, treat it as leaked and rotate it.
Quick check
Should the full vulnerability description go in the message?
No. Give a one line summary and link to the record. Chat is for starting action, not storing detail.
Which alerts belong in a channel and which in a digest?
Send an alert when a person must decide soon, such as a new reachable critical finding. Send routine counts and low severity items in a periodic digest.
Safeguard's reachability analysis can help you say whether a vulnerable function is actually called, and you can try a free scan at gold.safeguard.sh/scan.
Last reviewed: 19 October 2026.
