SmartRetro reads working signals from GitHub and GitLab: the shape of delivery, not the code itself. It never stores your source. What it looks at is metadata — pull requests and merges, pipeline outcomes, the timing and ownership of work — the events that tell you where a team is getting stuck.
What it reads
From a connected code host, SmartRetro surfaces patterns like work that merged but left its tracker issue open, review or delivery bottlenecks, and repeated pipeline failures on the same ref. GitLab pipeline failures and deploy events feed drift and delivery signals; GitHub pull-request and merge activity feeds the same. Every resulting signal links back to the original event on your host. Source code is never read or stored — only the metadata of the events.
Connecting
Code hosts connect by webhook. In Settings → Integrations, enable the provider you want and SmartRetro shows the webhook endpoint for your organization plus a place to set a signing secret. Add the webhook to your GitHub org/repo or GitLab project pointing at that endpoint, paste the same secret into both sides, and events start flowing.
The secret is the security boundary: every incoming webhook is verified against it before anything is processed. An unsigned or wrongly-signed request is rejected. If a secret is rotated on one side but not the other, the mismatch flips the integration’s health to “action needed” so you’re prompted to re-verify rather than silently losing events.
Enabling and disabling
Each provider can be enabled or disabled independently from its card. Disabling stops events being accepted; the endpoint stops processing them immediately.
How signals reach a team
Code-host signals follow the same routing rules as everything else — see Signals and Teams and scope. What SmartRetro stores and for how long is on the Trust & security page.
Next
Round out the feed with a tracker so action items can be exported and their completion cross-checked, or connect Slack for the richest signal source.