Codluma relies on webhooks from your Git and CI/CD providers to trigger reviews and failure analyses in real time. Webhooks are configured automatically when you connect a provider — this section documents the technical details for network teams and security auditors.
Inbound webhook endpoints
Provider
Codluma endpoint
Auth method
GitHub
https://hooks.codluma.ai/github
HMAC-SHA256 (X-Hub-Signature-256)
GitLab
https://hooks.codluma.ai/gitlab
Secret token header (X-Gitlab-Token)
Bitbucket
https://hooks.codluma.ai/bitbucket
JWT (X-Hook-UUID + HMAC)
GitHub Actions
https://hooks.codluma.ai/github-ci
HMAC-SHA256 (same App)
GitLab CI
https://hooks.codluma.ai/gitlab-ci
Same group token
Jenkins
https://hooks.codluma.ai/jenkins
API key (X-Codluma-Key)
CircleCI
https://hooks.codluma.ai/circleci
HMAC-SHA256
Signature verification
All inbound webhooks are verified using HMAC-SHA256 signatures before processing. Requests with invalid or missing signatures are rejected with HTTP 401.
webhook signature verification (TypeScript)
import { createHmac, timingSafeEqual } from 'crypto'
function verifyGitHubSignature(
payload: Buffer,
signature: string, // value of X-Hub-Signature-256 header
secret: string,
): boolean {
const expected = 'sha256=' + createHmac('sha256', secret)
.update(payload)
.digest('hex')
// Use timingSafeEqual to prevent timing attacks
return timingSafeEqual(
Buffer.from(signature),
Buffer.from(expected),
)
}
Security
Never compare webhook signatures with ===. Always use a constant-time comparison function like timingSafeEqual to prevent timing-based attacks that could allow signature forgery.
Firewall / IP allowlist
If your CI/CD environment sits behind a firewall, allow outbound webhooks to Codluma from these static egress IP ranges:
Codluma static IP ranges (allowlist these)
# EU region (default)
185.220.101.0/24
185.220.102.0/24
# US region (Enterprise US plan only)
198.51.100.0/24
203.0.113.0/24
Codluma can post real-time alerts to Slack channels or Microsoft Teams when critical findings are detected or pipelines fail.
Setting up Slack
1
Create a Slack appIn your Slack workspace, go to api.slack.com/apps → Create New App → From Scratch.
2
Enable incoming webhooksUnder Features → Incoming Webhooks, toggle on and click Add New Webhook to Workspace. Choose the channel.
3
Copy the webhook URLCopy the generated URL (starts with https://hooks.slack.com/services/…).
4
Paste into CodlumaIn Settings → Notifications → Slack, paste the URL and configure which events trigger notifications.
Configurable notification events
Event
Default
Notes
Critical finding on PR
On
Fires immediately when a Critical severity finding is posted
Pipeline failure analysis ready
On
Fires when a failure analysis is complete
PR review complete summary
Off
Posts a full summary when a review is finished (can be noisy)
Daily digest
Off
Once-daily summary of findings and failures
Weekly analytics report
Off
PDF-style summary of the past week
Setting up Microsoft Teams
Teams integration uses an Incoming Webhook connector. In your Teams channel, click ⋯ → Connectors → Incoming Webhook → Configure. Name it, copy the URL, and paste it into Settings → Notifications → Microsoft Teams.
Warning
Slack and Teams webhook URLs are sensitive credentials — treat them like API keys. Codluma stores them encrypted at rest (AES-256) and never exposes them after initial save.
Codluma applies different retention policies to different data categories based on regulatory requirements and product usefulness.
Default retention periods
Data type
Retention period
Configurable
PR diffs / CI logs (sent for AI analysis)
Not stored — processed in memory only
No
Review findings (titles, severity, location)
24 months
Yes (Business+)
Failure analysis results
24 months
Yes (Business+)
Analytics aggregates
36 months
Yes (Business+)
Account & billing data
Life of account + 30 days
No
Financial records
7 years
No (legal obligation)
Audit logs (Enterprise)
12 months
Yes (Enterprise)
Configuring custom retention
Business and Enterprise plans can configure custom retention periods under Settings → Data & Privacy → Retention.
Note
Deleting individual repositories from Codluma immediately queues deletion of all associated review findings and failure analyses, completing within 24 hours.
Single Sign-On (SSO) via SAML 2.0 is available on Business and Enterprise plans. SSO lets your team sign in with their existing corporate credentials and enables centralized access control through your identity provider (IdP).
Tested identity providers
Okta
Microsoft Entra ID (Azure AD)
Google Workspace
OneLogin
Ping Identity
JumpCloud
SAML setup steps
1
Generate your SP metadataGo to Settings → Security → SSO and click Enable SSO. Copy your Entity ID and ACS URL.
2
Create the SAML app in your IdPIn Okta/Entra/Google, create a new SAML 2.0 application. Paste in the Entity ID and ACS URL. Set the Name ID format to EmailAddress.
3
Configure attribute mappingsMap the following IdP attributes:
IdP attribute
Codluma field
email
email
firstName
first_name
lastName
last_name
department (optional)
team
4
Upload IdP metadataDownload the XML metadata from your IdP and upload it under Settings → Security → SSO → Upload Metadata.
5
Test before enforcingClick Test SSO to verify, then enable Enforce SSO to require all team members to authenticate via your IdP.
Warning
Before enabling Enforce SSO, ensure at least one Owner account is provisioned in your IdP. Enabling SSO enforcement without an IdP-provisioned owner will lock all users out of the organization. Emergency recovery requires contacting support@codluma.ai.
SCIM provisioning (Enterprise)
Enterprise plans support SCIM 2.0 for automated user provisioning and deprovisioning. When an employee is deactivated in your IdP, their Codluma account is automatically suspended — no manual cleanup needed.
SCIM base URL + auth (Enterprise)
Base URL: https://api.codluma.ai/scim/v2
Auth: Bearer token (generated in Settings → Security → SCIM)
Supported: User create, update, deactivate, group sync
We use cookies and analytics to understand how you interact with Codluma and improve your experience. We never sell your data. See our Privacy Policy and Terms for details.