On the Agency plans, findings can go straight into the tool your team already works in: GitHub, Jira Cloud or Linear. Each ticket carries what is wrong, the fix, the evidence and a link to the report, and it is updated when an audit sees the problem fixed.

Connect a tracker

Open the Alerts page and go to the Tickets section.
Choose the tracker and fill in its settings:
- GitHub: the repository and a token. A fine-grained token limited to this repository, with the permission “Issues: Read and write”, is best (GitHub → Settings → Developer settings → Fine-grained tokens). A classic token works too, but gives access to everything the account can reach.
- Jira Cloud: the site (your-team.atlassian.net), the project key, the issue type, the account e-mail and an API token from id.atlassian.com → Security → API tokens. The token has the rights of that account: a dedicated account is best. Jira Cloud only.
- Linear: the team key and a personal API key (Linear → Settings → Security & access → Personal API keys). The key has the rights of your account.
Choose which new findings open a ticket: critical, high or critical, or medium or worse.
Tick Automatically after each audit, or leave it off to open tickets only by hand from the report.
On the Agency plans with clients, you can limit the tracker to one client’s domains.
Press Connect. The settings are tested with the tracker before they are saved, and the token is stored encrypted.

Only owners and admins can connect, pause, test or remove trackers. A workspace can have up to ten.

What opens a ticket automatically

After each audit, each new finding at or above the severity you chose becomes a ticket, with these exceptions:

never on a domain’s first audit, so connecting a tracker does not flood it with the existing findings;
never for a finding you accepted as a risk;
ten tickets at most per tracker and per audit.

A finding that comes back after a fix gets a new ticket.

Open a ticket by hand

On the latest report of a proved domain, Open a ticket (or Open a GitHub ticket, when only one tracker can take it) sends any finding to your tracker. The finding then links to its ticket. Viewers cannot open tickets.

When the problem is fixed

When a complete audit no longer finds the problem, the ticket gets a comment saying so. On GitHub, the issue is also closed.

Manage your trackers

The Tickets table on the Alerts page shows each tracker, what opens its tickets, how many were opened and its status. From there you can switch it between Automatic and On request only, test it, pause it or remove it. Removing a tracker leaves the tickets already opened in the tracker.