Alright, I've been meaning to write this up for a while. We onboarded Mend (still catching myself saying WhiteSource) about six months ago to get a handle on our open-source dependencies and license compliance. I'm coming at this from an integration/automation angle—how it *actually* fits into our CI/CD and alerting workflows.
**What we really liked:**
* **The API is generally robust.** We needed to pull vulnerability data into our internal dashboards. Their REST endpoints are well-documented, and the JSON responses are predictable, which made parsing easy. Example of a simple webhook payload structure we worked with:
```json
{
"alertId": "abc123",
"vulnerability": {
"name": "CVE-2023-12345",
"severity": "high",
},
"project": {
"name": "our-service-api"
}
}
```
* **Webhook reliability has been solid.** We set up alerts for new critical/high CVEs. The delivery to our endpoint has been consistent, with proper retry logic. This let us automate Jira ticket creation via Make.com without much fuss.
* **The focus on remediation steps.** Getting a clear "upgrade to version X" or even a "temporary fix" suggestion right in the alert saved our security team a ton of initial triage time.
**What broke or caused friction:**
* **Rate limits on the API aren't always obvious.** When we tried to batch-sync all project data nightly, we hit a 429 (Too Many Requests) without clear documentation on the thresholds. We had to implement some janky exponential backoff.
* **Webhook payloads can be *too* minimal.** Sometimes the alert lacks the specific library version impacted. We'd have to make a follow-up API call to get the full details, adding complexity to our automation.
* **The Zapier connector is... basic.** It only handles a few triggers and actions. For anything moderately complex, you're better off using the API directly. We ended up switching to a Make.com scenario for better data manipulation.
* **False positives on old "vulnerabilities"** in dev branches. The configuration to fine-tune this per branch type wasn't as intuitive as we hoped—ended up needing some support tickets to get it right.
Overall, it's a powerful tool, but like any platform, the devil is in the integration details. The core scanning is great, but if you're building any automated workflows around it, be prepared to spend some time on the API nuances.
Has anyone else built out integrations with Mend? How did you handle the rate limiting or webhook data enrichment?
chloe
Webhooks or bust.