Docs

Slack

Connect one Slack channel per organisation. Stackat posts there when a new issue needs attention soon, and sends a short digest every Monday.

Connecting#

On the dashboard, open Settings and find the Slack box.

1. Press Add to Slack.
2. On Slack's own screen, pick the workspace and the channel, and allow it. There is nothing to copy.
3. You are back on Settings, which shows "Connected to #channel in Workspace". Stackat posts a first message in the channel that lists what will arrive there.

Only an administrator of every repository Stackat can read (in practice an organisation owner) can connect, change or remove Slack, because the messages name every repository. Everyone else sees where the messages go.

Once connected:

• Send a test message posts a short message that lists what arrives (one a minute per organisation).
• Change channel runs Add to Slack again; what gets sent is kept.
• Disconnect asks on a second screen ("Disconnect #channel?"), never in one click.

What gets sent#

After each scan, Stackat posts about each new issue that meets your settings, once per issue. Choose under What gets sent:

A message looks like this:

🔴 Vulnerability fix available
ingress-nginx 4.10.0 → 4.11.3 in acme/web · patch urgency 82/100, 3 CVEs fixed · safe to upgrade
Open the issue

The other headings are "🔥 Actively exploited vulnerability fixed by an upgrade" and "🟠 Upgrade with changes needed in your repository". Issues that already existed before you connected are not announced.

Buttons on alerts#

Alerts in a channel connected with Add to Slack carry buttons, so you can act without leaving Slack:

• Open pull request: the same as replying /stackpaw pr on the issue. Shown only with the Stackpaw app on Team or a trial, and only while no Stackat pull request is open for that issue.
• Ignore this tool: the same as /stackpaw ignore, after a confirmation. Undo it with /stackpaw track on the issue.
• View issue: opens the GitHub issue.

Linking your GitHub account. The first time you press a button, Slack shows you (and only you) a Link your GitHub account button. You sign in with GitHub once and confirm; from then on your presses count as you. Every press is checked against the same rules as a comment on the issue: your role in the repository and any commands list in .stackat.yml. When you may not do something, Slack tells you why, privately.

Each action leaves a trail: a comment on the GitHub issue ("Pull request requested from Slack by @you") and the Slack message changes to show who pressed what. Pressing twice, or two people at once, opens one pull request.

You can unlink yourself on the dashboard's Settings tab; an organisation admin can remove every link there, and disconnecting Slack removes them all. Stackat stores the link sealed (your Slack user and your GitHub account), never your name.

Channels connected with a pasted incoming webhook get only View issue: their button presses would go to your own Slack app, not to Stackat.

Weekly digest#

Every Monday at 07:00 UTC, one short message per organisation, in the same channel. In order:

1. a header naming the week that starts;
2. Needs attention: the three highest-risk open items, ranked like the dashboard's Next up, with links;
3. Last week (Monday to Sunday) in one line: issues opened and upgrades completed, naming up to three;
4. Up to date: how many tools are, as on the dashboard's card, with the change since last week;
5. on a trial, the days left; on the free plan, once a month, what Team adds;
6. a link to your dashboard.

Stackat weekly · acme · week of 2 Nov 2026
Needs attention: 6 tools behind, highest risk first
• 🔴 Cilium 1.14.5 → 1.16.1 in acme/infra · high risk
• 🔴 ingress-nginx 4.10.0 → 4.11.3 in acme/web · high risk
• 🟠 cert-manager 1.15.0 → 1.16.2 in acme/infra · medium risk
Last week: 4 new issues · 2 upgrades completed (Traefik, external-dns)
Up to date: 45 of 51 tools on their latest release (88%), up 6 points from last week
Open your Stackat dashboard

With up_to_date: {releases_behind: 1} the line reads "46 of 51 tools within 1 release of the latest (90%, your setting)". A week with nothing new, nothing done and nothing open is one line: "All caught up: every tool Stackat tracks in acme is on its latest release."

• Untick Weekly digest on Mondays to stop it; the other messages carry on.
• A digest that could not be sent on Monday is retried until Tuesday ends, then skipped rather than sent late.
• On the free plan the digest covers its one repository.
• Without Slack there is no digest.

Use an incoming webhook instead#

If your workspace does not allow adding apps, open the folded Use an incoming webhook instead section on Settings:

1. Create an incoming webhook for your channel in Slack (the section links to Slack's guide).
2. Paste its address. It starts with https://hooks.slack.com/services/.
3. Stackat checks the address and sends a first message before keeping anything, so a wrong or revoked webhook shows at once.

The check says which part of a pasted address is wrong, for example:

• "That is a Slack token, not a webhook URL."
• "That is a Workflow Builder webhook. Stackat needs an incoming webhook, whose address has /services/ in it."
• "The webhook URL looks cut off: after /services/ it has three parts (T…/B…/…). Copy it again with Slack's Copy button."
• "The webhook URL must start with https://, not http://."

The webhook address is a secret: Stackat keeps it encrypted, never in git, and deletes it when you disconnect or leave.