Security alerts and the daily alert summary

fremforge sends three kinds of security email. This page covers the first two:

Security alert: sent at once, one email per organisation, for anything that should be looked at today.
Daily alert summary: one email a day per person, at 07:00, covering every organisation you get security alerts for. It holds what needs attention, but not at once.
Weekly security digest: a trend report with counts only and no individual findings.

What is sent at once, and what waits

Sent at once (security alert)	In the daily alert summary
A new CRITICAL finding. Every committed secret and every malware finding is CRITICAL, so these are always sent at once.	A new HIGH finding: on a default branch, in a pull request, or on a protected release branch.
A finding that became known exploited (ENISA EUVD or CISA KEV), whatever its severity. See finding alerts.	A finding that became reachable at MEDIUM or LOW severity.
A finding that became reachable at HIGH or CRITICAL severity.

With the summary switched off, everything in the right-hand column is sent at once too, one email per organisation, the way it worked before 20 October 2026.

When the summary is sent

The summary goes out once a day at 07:00 Copenhagen time (Europe/Copenhagen). fremforge does not store a time zone per person, so this time is the same for everyone. If nothing is new in any of your organisations, no email is sent.

One email covers all your organisations. Each organisation has its own section, and only organisations where your own Security alerts setting is on are included.

Who receives it

The recipient rules are the security alert’s, per organisation:

every member whose own Security alerts setting is on for that organisation;
you must still be a member: someone who has left the organisation receives nothing, even if their old setting is still stored;
nothing is sent for an organisation that has been cancelled or deleted;
bot accounts never receive mail.

Owners see each finding: repository, package or file, and advisory, with links to the console. Members get counts only, with no repository, path or package names, because the security console is owner-only and a member may not have access to every repository.

The email is in your language (English, Danish, German, French, Dutch or Swedish). The subject line uses plain ASCII characters.

Switching it off

The summary is on by default for everyone. To get every security alert as soon as it is found instead, open your notification settings and turn off Daily alert summary. The setting is per person, not per organisation, and applies to all your organisations. Every summary email links to it.

Each finding once

A finding is sent to you once, whichever email it goes in:

A finding listed in a summary is not sent again the next day, or at once if you later switch the summary off.
A finding already sent at once is not listed in a later summary if you switch the summary on.
A transition (became reachable, became known exploited) still alerts at most once per finding, ever. See finding alerts.

Webhooks, SIEM and the audit log are not batched

Only the email is collected into the summary. Every transition is written to the audit log when it is detected, and reaches your SIEM endpoints and alert webhooks straight away, whatever anyone’s email setting.