Vulnerability alerts for the things you actually run
Pick your stack, optionally paste a lockfile, and hear from us only when something is being exploited, is likely to be, or is critical with a fix waiting. The rules are printed below — check our arithmetic.
- Cost
- Free. No card.
- Account
- None. No password.
- Delivery
- Email only
- Cadence
- Instant, daily or weekly
- We store
- Address, stacks, package names + versions
- Upstream
- OSV.dev · CISA KEV · FIRST EPSS
1 Publish rules
Severity on its own never qualifies an alert. A CVSS 9.8 that nobody is exploiting and nobody can fix is not news, and treating it as news is why people stop reading.
| Condition | Source | Result |
|---|---|---|
| Listed as known exploited | CISA KEV | Sends. Always, fix or no fix — you need to know even when the only move is mitigation. |
| Exploitation probability ≥ 10% in 30 days | FIRST EPSS | Sends. |
| CVSS ≥ 9.0 and a fix exists and EPSS is not negligible | OSV / NVD | Sends. All three, not any one. |
| A platform incident a curator has reviewed | Vendor advisory | Sends. A person reads the disclosure first. |
| Anything else | — | Recorded, not sent. This is most of what gets published. |
2 Worked example
The two shaded rows are the argument. A severity-ranked tool puts CVSS 7.4 above CVSS 6.9 and alerts on the first. We do the opposite, because one is being exploited right now and the other has a 5% chance of ever being exploited.
| Advisory | Package | CVSS | EPSS | KEV | Verdict | Decided by |
|---|---|---|---|---|---|---|
CVE-2021-44228 |
log4j-core | 10.0 | 99.99% | yes | SENT | KEV listing |
CVE-2020-11023 |
jquery | 6.9 | 84.9% | yes | SENT | KEV listing |
CVE-2021-23337 |
lodash | 7.2 | 21.3% | — | SENT | EPSS ≥ 10% |
CVE-2020-8203 |
lodash | 7.4 | 5.2% | — | HELD | Below every threshold |
CVE-2020-28500 |
lodash | 5.3 | 7.3% | — | HELD | Below every threshold |
CVE-2022-24894 |
symfony/http-kernel | 5.9 | 4.0% | — | HELD | Below every threshold |
CVSS from NVD. EPSS from FIRST, as of 2026-10-23. KEV membership from CISA catalog 2026.10.23. EPSS is re-scored daily, so these figures move — every one of them is checkable against the source today.
3 Coverage
- Your packages, at your versions. Paste
package-lock.jsonorcomposer.lockand we match the resolved tree against OSV — your lodash, not lodash in general. - Stacks you name. 52 platforms and frameworks, plus anything you type in. Stack alerts need no dependency file at all.
- Platform incidents. Hosting and SaaS disclosures that never get a CVE, which pure CVE trackers miss entirely.
- Actionable from the inbox. Affected range, fix version, what to do, official links, and which of your selections matched. There is no dashboard to log into.
- Nothing uploaded. Dependency files are parsed in your browser. Only
{ecosystem, name, version}is ever sent.
4 Data sources
| Source | What it decides | Why this one |
|---|---|---|
| OSV.dev | Whether your exact version is affected | Version ordering differs per ecosystem — semver, Composer stability flags, PEP 440. OSV maintains those comparisons properly, so we send it a version and take its answer. |
| CISA KEV | Confirmed exploitation | Every entry is observed in the wild. 1,756 entries as of catalog 2026.10.23 (2026-10-23); we re-mirror hourly, so the live figure moves. |
| FIRST EPSS | Exploitation probability | The strongest noise filter that exists for free. Most CVEs score under 1%, which is exactly the population worth keeping out of an inbox. |
| GitHub Advisory Database | Advisory text and affected ranges | Reached through OSV, which ingests it. |
| Vendor feeds & status pages | Platform incidents | Hosting and SaaS disclosures that never receive a CVE. No score exists for these, so a person reviews each one. |
5 Limits
Stated here rather than discovered later. A security tool that overstates its coverage is worse than none.
- Lockfiles give the resolved tree; manifests give guesses.
package.jsonholds ranges like^1.2.3, which we resolve to the range floor and label lower-confidence in both scoring and the email. - No reachability analysis. We cannot tell whether your code calls the vulnerable function.
- Stack alerts come from KEV. They will not catch a vulnerability that never reaches the catalog.
- CVSS v4-only advisories are not scored numerically; they fall back to their severity label.
- Platform coverage is only as good as the feed list, and every incident waits on a human.