Webhooks, Email Alerts, and the Embedded Report Form

Configure email notification preferences, set up Zapier webhooks, and embed the Hackrate report form on your own website for VDP programs.

Hackrate offers several ways to push information out of the platform and into your team’s workflow: per-user email notifications that each person can tune to their own preferences, Zapier webhooks for custom automation pipelines, and — for Vulnerability Disclosure Programs (VDP) — an embeddable report form that lets researchers submit reports without ever visiting the Hackrate website. This page explains all three and how to configure each one.

Email Notifications

Every Hackrate user can configure their own email notification preferences. Notifications are sent from the platform to your registered email address and can be enabled or disabled per event type.

Notification Event Types

New Reports

Receive an email when a new vulnerability report is submitted to a program you administer. Useful for ensuring nothing is missed even when you’re not actively logged in.

Report Updates

Get notified when the status of a report changes — for example, when a report you submitted or are managing moves to Accepted, Resolved, or Duplicate.

Comments

Receive an email when a new public comment is posted on a report you’re involved with.

Internal Comments

Receive an email when a new internal (team-only) comment is posted on a report. Only visible to admins with triage access.

File Attachments

Get notified when a new file or evidence attachment is added to a report.

Marketing Updates

Platform announcements, new feature releases, and other communications from the Hackrate team.

Email Content Level

In addition to toggling individual event types, you can control how much detail each notification email contains:

Level	What you receive
Minimal	A brief subject line and a link to the item in Hackrate — no vulnerability details in the email body. Best for security-conscious environments where email may be archived or forwarded.
Typical	A short summary with the report title, severity, and status — enough context to prioritize without the full report content.
Full	The complete report content, including title, description, summary, impact, and any comments included in the notification trigger. Convenient for quick triage from your inbox.

If your organization has a policy against including sensitive information in email, set all users to Minimal content level. This ensures vulnerability details stay inside Hackrate and are only accessible to authenticated users with the correct role.

Configuring Your Email Preferences

Navigate to your Profile Settings → Notification Preferences to enable or disable each event type and to select your preferred content level. Each user manages their own preferences independently — there is no org-wide default override.

Zapier Webhook Integration

For teams that need to route Hackrate events into custom automation pipelines, the Zapier integration provides a webhook trigger that fires on report events. You can connect this to hundreds of downstream apps — from project management tools and ticketing systems to communication platforms and custom APIs.

1. Create a Zapier webhook trigger

   In Zapier, create a new Zap and choose Webhooks by Zapier → Catch Hook as the trigger. Zapier provides a unique webhook URL for this Zap.

2. Add the webhook to your program

   In Hackrate, go to your program’s Settings → Integrations and find the Zapier section. Paste the webhook URL and save.

3. Trigger a test event

   Update a report status or add a comment in Hackrate. Zapier will receive the payload, allowing you to inspect the data fields and map them to your automation’s next steps.

4. Build and activate your Zap

   Add action steps in Zapier — for example, create a Jira ticket, send a formatted Slack message, update a Google Sheet row, or trigger a PagerDuty alert. Activate the Zap when ready.

Each program can have one Zapier webhook URL configured. If you need to fan out events to multiple systems, use Zapier’s Multi-Step Zaps or a tool like Make (formerly Integromat) with a single inbound webhook that dispatches to multiple actions.

Embedded Report Form for VDP Programs

If your program is a Vulnerability Disclosure Program (VDP), you can embed the Hackrate report submission form directly on your own company website — for example, on a security.yourcompany.com page or in your security policy. This allows researchers to submit reports without needing to navigate to Hackrate directly, making it easier for non-technical reporters and reducing friction in the disclosure process.

How the Embedded Form Works

When a program is marked as embeddable, Hackrate serves a standalone report form that you can include in your website via an <iframe>. Reports submitted through the embedded form are received and processed exactly like any other report — they appear in your Hackrate inbox and trigger the same notifications, triage workflow, and status management.

The embedded form is only available on active, non-paused VDP programs that have been explicitly enabled for embedding in program settings.

Enabling and Embedding the Form

1. Enable embedding in program settings

   In your program’s Settings, find the Embedded Report Form option and enable it. This marks the program as embeddable.

2. Get the embed URL

   The form is served at the following URL, where {alias} is your program’s alias:

   https://app.hackrate.com/Reports/EmbeddedReportForm?program={alias}
   

   Replace {alias} with your actual program alias.

3. Add the iframe to your website

   Embed the form on your security disclosure page using a standard HTML iframe:

   <iframe
     src="https://app.hackrate.com/Reports/EmbeddedReportForm?program=your-program-alias"
     width="100%"
     height="800"
     frameborder="0"
     title="Vulnerability Disclosure Report Form">
   </iframe>
   

   Adjust the height value to suit your page layout.

4. Test the submission

   Submit a test report through the embedded form on your website and confirm it appears in your Hackrate inbox. Check that your notification settings fire correctly for embedded submissions.

How embedded submissions are identified in Hackrate

Reports submitted through the embedded form are flagged as embedded submissions in Hackrate. This distinction is visible on the report management page and in CSV exports (the “VDP” column), letting your triage team know the report came in through the public disclosure form rather than through a registered hacker account.

If the submitter provides an email address and that address matches an existing Hackrate account, the report is linked to that account automatically. Otherwise, the submission is stored with the contact information the reporter provided.

Link your embedded form directly from your security.txt file and your website’s footer. Researchers actively looking for a place to report vulnerabilities will check both of these locations first.