Zapier

Sending alerts to Zapier

Connect cside to Zapier to automatically send your security alerts into no-code “Zap” workflows. From there you can route each alert to thousands of downstream tools - Slack, Microsoft Teams, email, PagerDuty and other incident tools, Jira, CRMs, spreadsheets, and more.

The integration is outbound only. cside pushes alerts to Zapier as a trigger source, and Zapier never controls anything inside cside. You build a Zap that starts with “When cside detects a new security alert…” and chain any Zapier action after it.

Alerts are team-scoped. Connecting authorizes a single team, and only that team’s alerts flow to Zapier.

Connecting cside to Zapier

Connecting is a one-time setup that uses OAuth, so there are no API keys to copy or paste.

1. Open the dashboard and navigate to Team Settings > Integrations
2. Click Connect Zapier
3. This opens the cside app in Zapier. Authorize it and select which team to share alerts from
4. Once authorized, cside is available as a trigger source when you build Zaps

Building a Zap with a cside trigger

In Zapier, create a Zap and choose a cside trigger to start it. There are five triggers to choose from:

Trigger	Fires when
New security alert	Any alert is raised. This is the catch-all trigger for every event.
Script threat detected	A script matches a threat rule in the rules engine.
Vulnerable script detected	A script uses a library with a known low or medium severity vulnerability (CVE).
High-risk vulnerability detected	Malware or a high-severity vulnerability is found.
cside managed-list flagged	A script matches cside’s managed blocklist.

After choosing a trigger, add whatever downstream action you want - post to a Slack channel, open a Jira ticket, page your on-call rotation, log to a spreadsheet, email a distribution list, and so on. Alerts then flow to your Zap automatically.

The alert payload

Each alert is delivered to Zapier as JSON. Every alert includes these fields:

Field	Description
type	Which trigger fired (e.g. vulnerable_script_detected)
domain	The domain where the script was seen
scriptUrl	The URL of the offending script
severity	The alert severity (e.g. high, critical)
title	A human-readable summary of the alert
description	A longer human-readable description of the alert
detectedAt	When the alert was detected, as an ISO-8601 timestamp
dashboardUrl	A deep link back to the alert in the cside dashboard
isTest	true for test or validation alerts (the title is prefixed with [TEST])

Vulnerability alerts include three additional fields:

Field	Description
vulnerabilityId	The CVE identifier for the vulnerability
vulnerabilityUrl	A reference link for the CVE
recommendation	Remediation guidance for the vulnerability

A vulnerability alert payload looks like this:

{
  "type": "vulnerable_script_detected",
  "domain": "shop.example.com",
  "scriptUrl": "https://cdn.example.com/checkout.js",
  "severity": "high",
  "title": "Vulnerable script detected on shop.example.com",
  "description": "checkout.js loads a library version with a known vulnerability.",
  "detectedAt": "2026-01-15T09:24:00Z",
  "dashboardUrl": "https://dash.cside.com/...",
  "isTest": false,
  "vulnerabilityId": "CVE-2024-12345",
  "vulnerabilityUrl": "https://nvd.nist.gov/vuln/detail/CVE-2024-12345",
  "recommendation": "Upgrade the library to the latest patched version."
}

Testing the connection

Before going live, you can test the connection from Zapier. When you set up a trigger, Zapier can pull a sample alert payload so you can confirm the data flows through as expected. Test alerts are clearly marked: isTest is true and the title is prefixed with [TEST].

Disconnecting

To stop sending alerts to Zapier, open the dashboard, navigate to Team Settings > Integrations, and click Disconnect next to Zapier.

Disconnecting stops all alert delivery and removes every Zap subscription for that team.

Security

• Team-scoped - connecting authorizes a single team, and only that team’s alerts are shared with Zapier.
• Zapier endpoints only - when a Zap subscribes to a cside trigger, cside delivers alerts only to the webhook endpoint Zapier provides, and those endpoints are restricted to Zapier’s own domains (*.zapier.com).
• OAuth 2.0 - cside acts as the authorization server, so you never handle raw tokens or secrets.