All templates

Automated HackerOne Critical Report Alerts

Every hour, WebRun opens HackerOne, checks for new vulnerability reports, posts a summary of each new report to Telegram, and sends a Twilio text to your security lead when a critical severity report needs same day triage.

Deploy this workflow Browse all templates
Runs on WebRun · Strict Lockdown policy
Every hour WebRunorchestrates each step
1 HackerOne check for new reports
2 Telegram post the report summary
3 Twilio text critical reports
In short

How do I get alerted the moment a critical HackerOne report comes in?

WebRun checks HackerOne every hour for new vulnerability reports, posts a summary of each to your security team's Telegram channel, and sends a Twilio text alert the moment a report comes in as critical severity. It only reads and relays reports, so triage and payout decisions stay with your team.

  • Critical reports reach the on call lead within the hour
  • Every new report is visible in Telegram as it lands
  • Report triage and payouts stay a human decision

Built for security teams · AppSec engineers · vulnerability management · SOC analysts

Step by step

What does WebRun do on every run?

The exact actions WebRun takes, in order - in plain language, so you can adjust anything.

  1. WebRun signs in and gets to work

    Opens hackerone.com in a real browser with your saved login - no setup, no API keys.

  2. 1
    HackerOne - check for new reports
    hackerone.com
    WebRun in HackerOne: check for new reports
    WebRun opens HackerOne to check for new reports.
    • Open the HackerOne inbox and filter to new and unreviewed reports
    • Read each report's title, severity, and affected asset
    • Sort by severity so critical and high reports surface first

    Done when Every new report since the last run has a read severity and summary.

  3. 2
    Telegram - post the report summary
    telegram.org
    WebRun in Telegram: post the report summary
    WebRun opens Telegram to post the report summary.
    • Post a summary of each new report to the security team's Telegram channel
    • Include the severity, title, and a link back to the report
    • Leave triage, scoping, and payout decisions to the team

    Done when Every new report is posted to Telegram.

  4. 3
    Twilio - text critical reports
    twilio.com
    WebRun in Twilio: text critical reports
    WebRun opens Twilio to text critical reports.
    • For any report marked critical severity, send a text alert via Twilio to the on call security lead
    • Keep the text to the report title and severity only
    • Skip the text for medium and low severity reports

    Done when Every critical report has triggered a text alert.

Run settings

How is each run configured?

Starting pageWhere Chrome opens at the start of each run
hackerone.com
ScheduleRuns automatically on this cadence
Every hour
DeliveryHow each run's result reaches you
Report alert · Telegram
OutputWhat each run produces - A running feed of new HackerOne reports by severity, with a text alert for anything critical.
Text
Setup & safety

Secure by default

Connect once, stays signed in

WebRun signs in once and keeps each session in a persistent environment, so every run picks up right where it left off.

Your credentials stay in your own private environment - WebRun never stores your passwords.
Strict Lockdown

Every action is checked against this policy before it runs.

Domains ALLOWLIST
Typed input ALLOW
Shell command BLOCK
File uploads BLOCK
Runs in a contained environment More on policies
Good to know

Questions, answered

Will WebRun close, resolve, or pay out a report?

No. WebRun only reads and alerts on new reports. Triage, validation, and any bounty payout stay entirely with your security team.

How is a critical report defined?

Whatever severity HackerOne itself assigns the report. WebRun reads that rating directly, it never re-scores or re-triages a report.

Does it message the hacker who submitted the report?

No. WebRun never contacts a reporter. It only relays report summaries internally to your own Telegram and Twilio alerts.

Keep going

Related templates

Automated 1Password Vault Health Reports
Every week, WebRun reviews your 1Password vaults for weak, reused, and old shared items, logs each flagged item in Airtable, and posts a summary scorecard to Notion.
1Password›Airtable›Notion
Automated Abnormal Security Impersonation Digest
Every morning, WebRun checks Abnormal Security for new detected threats targeting executives, logs each one to a Google Sheet, and emails your security team a daily digest.
Abnormal Security›Google Sheets›Gmail
Automated Absolute Security Fleet Scorecard
Every Monday, WebRun checks Absolute Security for devices that haven't checked in or show signs of tampering, posts a weekly scorecard to Telegram, and texts you if a device goes missing.
Absolute Security›Telegram›Twilio

Put this on autopilot.

Turn it on in minutes - or have our team set it up for you.

Deploy this workflow Talk to us