webhooks are the bit i’d use first. getting vuln reports straight into slack/pager/whatever beats yet another mailbox nobody checks, and the local exploit hazard thing sounds way more useful than staring at CVSS scores in isolation.