Zapier

Sending alerts to Zapier

Connect cside to Zapier to automatically send your security alerts into no-code “Zap” workflows. From there you can route each alert to thousands of downstream tools - Slack, Microsoft Teams, email, PagerDuty and other incident tools, Jira, CRMs, spreadsheets, and more.

The integration is outbound only. cside pushes alerts to Zapier as a trigger source, and Zapier never controls anything inside cside. You build a Zap that starts with “When cside detects a new security alert…” and chain any Zapier action after it.

Alerts are team-scoped. Connecting authorizes a single team, and only that team’s alerts flow to Zapier.

Connecting cside to Zapier

Connecting is a one-time setup that uses OAuth, so there are no API keys to copy or paste.

1. Open the dashboard and navigate to Team Settings > Integrations
2. Click Connect Zapier
3. This opens the cside app in Zapier. Authorize it and select which team to share alerts from
4. Once authorized, cside is available as a trigger source when you build Zaps

Building a Zap with a cside trigger

In Zapier, create a Zap and choose a cside trigger to start it. There are six triggers to choose from:

Trigger	Fires when
New security alert	Any alert is raised. This is the catch-all trigger for every event.
Script threat detected	A script matches a threat rule in the rules engine.
Vulnerable script detected	A script uses a library with a known low or medium severity vulnerability (CVE).
High-risk vulnerability detected	Malware or a high-severity vulnerability is found.
cside managed-list flagged	A script matches cside’s managed blocklist.
Malicious outbound connection	An outbound connection from one of your pages reaches a hostname on cside’s managed threat list.

After choosing a trigger, add whatever downstream action you want - post to a Slack channel, open a Jira ticket, page your on-call rotation, log to a spreadsheet, email a distribution list, and so on. Alerts then flow to your Zap automatically.

The alert payload

Each alert is delivered to Zapier as a JSON array holding a single alert object. Every alert includes these fields:

Field	Description
id	The alert target: the script hash, URL, IP, domain, hostname, or vendor the alert is about
type	The kind of target: HASH, URL, IP, DOMAIN, HOSTNAME, or VENDOR
domain	The domain where the script was seen
scriptUrl	The URL of the offending script
severity	For vulnerability alerts, the vulnerability severity in lowercase (e.g. medium, high, critical). Every other alert is high
title	The text cside security alert, a long dash, and the domain
description	The description of the ruleset that raised the alert
detectedAt	When the alert was delivered, as an ISO-8601 timestamp
dashboardUrl	A deep link back to the alert in the cside dashboard
isTest	true for test or validation alerts (the title is prefixed with [TEST])

Vulnerability alerts include three additional fields:

Field	Description
vulnerabilityId	The CVE identifier for the vulnerability
vulnerabilityUrl	A reference link for the CVE
recommendation	Remediation guidance for the vulnerability

A vulnerability alert payload looks like this:

[
  {
    "id": "https://cdn.example.com/checkout.js",
    "type": "URL",
    "domain": "shop.example.com",
    "scriptUrl": "https://cdn.example.com/checkout.js",
    "severity": "high",
    "title": "cside security alert - shop.example.com",
    "description": "checkout.js loads a library version with a known vulnerability.",
    "detectedAt": "2026-01-15T09:24:00Z",
    "dashboardUrl": "https://dash.cside.com/...",
    "isTest": false,
    "vulnerabilityId": "CVE-2024-12345",
    "vulnerabilityUrl": "https://nvd.nist.gov/vuln/detail/CVE-2024-12345",
    "recommendation": "Upgrade the library to the latest patched version."
  }
]

The trigger that fired is not part of the payload. Zapier only delivers an alert to the Zaps subscribed to its trigger (or to New security alert), so use separate Zaps when you need to treat trigger types differently.

Testing the connection

Before going live, you can test the connection from Zapier. When you set up a trigger, Zapier can pull a sample alert payload so you can confirm the data flows through as expected. Test alerts are clearly marked: isTest is true and the title is prefixed with [TEST].

Disconnecting

To stop sending alerts to Zapier, open the dashboard, navigate to Team Settings > Integrations, and click Disconnect next to Zapier.

Disconnecting stops all alert delivery and removes every Zap subscription for that team.

Security

• Team-scoped - connecting authorizes a single team, and only that team’s alerts are shared with Zapier.
• Zapier endpoints only - when a Zap subscribes to a cside trigger, cside delivers alerts only to the webhook endpoint Zapier provides, and those endpoints are restricted to Zapier’s own domains (*.zapier.com).
• OAuth 2.0 - cside acts as the authorization server, so you never handle raw tokens or secrets.