Weekly Security Digest

What it is

The app already raises separate cards for the things that matter — a secret that may have reached the main branch, a device that signed in, spending that ran away, a cloud incident. Each one is its own interruption, and if you do not open the app for a week you see none of them.

The Weekly Security Digest is the opposite of an interruption: one summary, once a week, that answers "what happened on my machine in the last seven days?" It detects nothing new of its own. It counts and describes what the other signals already recorded, in plain words:

• Security alerts — every card raised in the week whose kind is a security one.
• Spend alerts that look like a runaway — spending alerts naming a runaway.
• Scan findings — what the secret scan and the dependency scan reported.
• Cloud incidents — any cloud incident that reached your inbox.
• What agents did through the control server — how many sessions agents started, how many alerts they raised, and how many requests were turned away, with a note when one address turned away a storm of requests.

Where to find it

The digest arrives on its own — there is nothing to open. It lands in your inbox as a card titled Weekly security digest, and the same text is emailed to you. There is no screen to visit and nothing to press.

To stop it, turn off Weekly security digest in Settings, next to the other briefing switches.

How it behaves

• It runs every week, covering the seven days that have just finished — Monday through Sunday — and it catches up as soon as the app next runs if the computer was switched off over the weekend. The digest never describes a week that has not happened yet.
• A quiet week still sends. The card and the email both say that nothing security-shaped happened, followed by every section with "none" against it — so you can always tell "nothing happened" apart from "the digest stopped".
• The email goes to you. It is sent to the email address of the account signed in on this computer. There is no address baked into the app, so it always follows whoever is signed in.
• If the email cannot be sent — nobody signed in, or no agent email set up — the card is still written, and it says plainly that there was nowhere to send the copy, with a button that opens your Email settings.
• A missing digest is itself a signal. If a digest has not gone out for more than a week, the app raises a clearly different card saying so and naming how long it has been. That is the card to act on: it means something is stopping the digest, not that the week was calm.
• One card per week. However many times the app restarts, a week produces one card and at most one email.
• It is on by default on every install, and turning it off stops the digest only — the app's other security cards keep working.

For agents

The service is src/main/services/security/weekly-security-digest-service.ts, armed by the startup task src/main/startup/tasks/2977-weekly-security-digest.ts and gated by the flat setting weeklySecurityDigestEnabled (default true). Its card family is the prefix weekly-security-digest- in src/shared/alert-definitions/security/weekly-security-digest.alert.ts; the week's key is weekly-security-digest-<YYYY-MM-DD> and the missed-digest key is weekly-security-digest-missed-<YYYY-MM-DD>. Content is built by the pure module src/main/services/security/weekly-security-digest-content.ts and sent through the existing sendAgentEmail transport, with the week as its idempotency key.

Related

Agent Email — for the address the digest is sent from and what the mail service can and cannot do. Notifications, inbox and voice — for how inbox cards behave, and how to mute or archive the ones you no longer want.