Forward pentest create notification fields

apps/app/src/app/(app)/[orgId]/security/penetration-tests/hooks/use-penetration-tests.test.tsx

@@ -231,6 +231,30 @@ describe('use-penetration-tests hooks', () => {
     expect(requestBody.checks).toEqual(['discovery', 'xss']);
   });
 
+  it('posts webhook and notification fields when creating a report', async () => {
+    fetchMock.mockResolvedValueOnce(
+      createJsonResponse({
+        id: 'run_notifications',
+        status: 'provisioning',
+      }),
+    );
+
+    const { result } = renderHook(() => useCreatePenetrationTest('org_123'), { wrapper });
+
+    await act(async () => {
+      await result.current.createReport({
+        targetUrl: 'https://app.example.com',
+        webhookUrl: 'https://hooks.example.com/pentest',
+        notificationEmail: 'security@example.com',
+      });
+    });
+
+    const init = fetchMock.mock.calls[0][1] as RequestInit;
+    const requestBody = JSON.parse((init.body ?? '{}') as string);
+    expect(requestBody.webhookUrl).toBe('https://hooks.example.com/pentest');
+    expect(requestBody.notificationEmail).toBe('security@example.com');
+  });
+
   it('supports creating a report without repository URL for black-box mode', async () => {
     fetchMock.mockResolvedValueOnce(
       createJsonResponse({

apps/app/src/app/(app)/[orgId]/security/penetration-tests/hooks/use-penetration-tests.ts

@@ -331,6 +331,8 @@ export function useCreatePenetrationTest(organizationId: string): UseCreatePenet
             repoUrl: payload.repoUrl,
             pipelineTesting: payload.pipelineTesting,
             testMode: payload.testMode,
+            webhookUrl: payload.webhookUrl,
+            notificationEmail: payload.notificationEmail,
             scanDepth: payload.scanDepth,
             evidenceLevel: payload.evidenceLevel,
             checks: payload.checks,
@@ -364,7 +366,8 @@ export function useCreatePenetrationTest(organizationId: string): UseCreatePenet
           error: null,
           failedReason: null,
           temporalUiUrl: null,
-          webhookUrl: null,
+          webhookUrl: payload.webhookUrl ?? null,
+          notificationEmail: payload.notificationEmail ?? null,
           scanDepth: payload.scanDepth,
           evidenceLevel: payload.evidenceLevel,
           checks: payload.checks,