Send an existing VAS security report to Slack with n8n

Bring a Vibe App Scanner report into your team's workflow without starting another scan. This guide reads one existing report, previews finding counts and coverage notes, and optionally sends that summary to a Slack channel.

n8n Cloud approval pending. The native VAS community node is published as n8n-nodes-vibe-app-scanner@0.1.0 for self-hosted n8n, but it is not yet n8n-verified or available as a native Cloud node. Cloud users can use the built-in HTTP Request version below. No native Cloud installation is required for that version.

Choose your template

Both templates follow the same path:

Manual trigger → configuration check → read existing scan → preview summary → optional Slack message

They ship inactive, with report reading disabled and Slack delivery off. There is no deployment trigger, scan-creation node, polling loop, replacement scan or summarization model call. These templates read VAS website standard/quick scan results; they do not audit n8n workflows, GitHub repositories or ZIP uploads.

Before you start

You need an account eligible for VAS REST API access, a VAS API key with scan:read only, and an existing scan belonging to that account. ChatGPT/MCP access alone does not provide REST API entitlement. Use your own authorized report; our internal demo report is not a public sample endpoint.

For Slack delivery, you also need a bot with chat:write and access to the destination channel. Invite the bot to the channel and copy the channel ID from Slack's channel details. Use the ID, not #channel-name. Do not grant broader permissions just to follow this guide.

Store keys only in n8n credentials, never in workflow JSON, a Code node, an expression, a screenshot or a support message. Restrict who can edit and execute the workflow. Review your instance's execution retention and error workflows: an HTTP response may temporarily contain account-permitted report details before the summary projection. The export disables execution-data saving, but instance logging, error handling and administrator policies also matter.

1. Import the workflow

Download the version for your setup. In the n8n editor, open the workflow menu and choose Import from file. Keep the workflow unpublished/inactive. Importing it does not read a report or send a message.

The HTTP version uses built-in nodes. For the native version, a self-hosted instance owner or admin must first install n8n-nodes-vibe-app-scanner@0.1.0 under Settings → Community nodes. It is an unverified community package that runs third-party code inside your instance; review the public source and test in a disposable instance before production use. Do not attempt this installation on n8n Cloud while approval is pending.

2. Bind the read-only VAS credential

Open Read existing scan and replace the credential placeholder.

• HTTP version: select a generic Bearer Auth credential and enter your VAS scan:read API key as its token. The template fixes the method to GET and the host to https://api.vibeappscanner.com; do not change them. It includes response status and body so the next step can distinguish a failed read from a zero-finding result. Redirects and automatic retries are off; the request times out after 15 seconds.
• Native version: create/select a Vibe App Scanner API credential with the same read-only scope. Leave the operation as Get Scan Status. The credential's Test action reads a bounded account scan-list page; it does not start a scan. Testing is optional for this tutorial.

You do not need scan:create, target-login credentials or billing access.

3. Choose an existing report and enable reading

Open an existing report in VAS. Copy only the UUID from the end of its dashboard URL. Open Configuration, an Edit Fields (Set) node, and change these fields:

The blank scan ID is deliberately invalid until replaced. Use fixed values, not expressions. The workflow validates the UUID before making a request; a URL or path will not work. Keep sendToSlack false for the first preview.

4. Preview the summary

Execute the manual workflow and inspect Preview report summary or Preview only. It makes one status read and no VAS write requests. Nothing is sent to Slack while delivery is off. If your n8n version requires every credential placeholder to be resolved before execution, disconnect the true branch from Slack delivery enabled to Send Slack summary for the preview; reconnect it only after setting up Slack.

The summary includes lifecycle state, total and per-severity finding counts, coarse coverage indicators and the authenticated report link. It does not copy finding descriptions, evidence, source code, raw provider errors or upstream links into Slack. The recipient still needs permission to open the report.

In our earlier test-account recording, the native node read an existing internal report and returned 11 reported findings, with coverage caveats. That demo did not create a scan. The saved receipt does not contain its exact severity or scanner-status breakdown, so those values are not invented here. The sanitized recorded observation contains only that confirmed total; it is not a complete API response or a promise of what your report will show.

Read the output carefully:

• Completed describes lifecycle success, not exhaustive coverage or a security certification.
• Unknown means a count or coverage value was not available in a usable form. It is not zero.
• Failed, cancelled or timed out reports can retain genuine findings. The template preserves reported terminal counts rather than discarding them.
• Pending reports have no final counts in this summary. The workflow does not poll; read the same report again later if needed.
• Unavailable means the read was not confirmed. Inspect account access and the original report; do not create a replacement scan to work around it.

5. Send to Slack when you choose

After reviewing the preview, bind a separate Slack Bearer Auth credential on Send Slack summary. Enter the bot token there, not the VAS key. In Configuration, set slackChannel to your fixed channel ID and explicitly change sendToSlack to true.

Run the manual workflow when you intend to send. This performs one VAS read and one Slack message request. Messages use plain text with mentions and link/media unfurls disabled. Confirm Slack delivery checks Slack's ok response; HTTP success alone is not enough.

If delivery is ambiguous, inspect the channel before retrying. Retry only Send Slack summary, using its existing sanitized input—not the full workflow. Duplicate notifications are possible; this template does not promise exactly-once delivery. No retry in this workflow can create a scan because no scan-creation operation exists.

To stop sending, set sendToSlack back to false. To stop reads too, set enabled to false. Revoke a temporary key when your demo is finished, and remove credentials before sharing a workflow export. The downloadable templates contain placeholders, no real report IDs and no pinned execution data.

Troubleshooting

Costs and next steps

Reading an existing report does not start another scan or add a summarization AI call. Normal VAS account requirements and API limits still apply, as do your n8n and Slack service charges. This tutorial does not benchmark total hosting or operating cost.

Once this read-only path fits your team, deployment-triggered scanning can be configured separately for an app you own or may test, with explicit permission, terms and available allowance. It is not enabled by these templates. Start with the VAS n8n integration page for current availability.

Official n8n references

• HTTP Request node and generic credentials
• Community node installation and the Cloud verification boundary