Operating the platform
Integrations
Where findings can go, and what credentials the platform holds.
Credentials the platform holds
Repository tokens and cloud credentials are stored encrypted and are read-only by design. A token is never returned to the interface after it is saved, and it is never included in a log line or an error message.
Tokens can be rotated in place, keeping the credential's identity and its history, or removed outright. Expiry is tracked and you are emailed before it happens rather than after a scan has already failed.
What this does not do
Automatic rotation is not possible: the platform holds a read-only token and cannot mint a replacement. Only the provider can issue one, so the notice says so rather than implying a button that cannot exist.
Sending findings elsewhere
Webhooks deliver scan and finding events to your own endpoint. The reference for their payloads and signature verification is on the Webhooks page.