Alerts and digests
The point of this product is fewer emails, not more. Here is exactly what triggers one, and every dial you can turn.
What triggers an email
We ingest advisories every 30 minutes and match them against the versions in your manifest. An email goes out when all of these are true:
- A new advisory affects a component you actually run.
- Its severity is at or above your instant threshold, which defaults to
high. - The match is against a real version, not a name mentioned in a blog post.
- The component is not a dev-only dependency, unless you turned those on.
- You have not snoozed or resolved that alert already.
Everything else goes into the digest. Nothing is dropped, it just waits.
Severity
| Severity | What it means | Default handling |
|---|---|---|
| critical | Remote code execution, authentication bypass, or anything already being exploited. | Instant email |
| high | Serious, exploitable without unusual conditions. Data exposure, privilege escalation. | Instant email |
| medium | Real but needs conditions you may not have. Often denial of service. | Daily digest |
| low | Minor, or needs local access. End-of-life warnings land here too. | Daily digest |
| unknown | No severity published yet. Common for advisories in their first hours. | Daily digest |
Severity comes from the advisory source, normalised onto one scale. Where a CVSS score exists we use it: 9.0 and above is critical, 7.0 to 8.9 high, 4.0 to 6.9 medium, below that low.
Exploited in the wild overrides everything
Match confidence
| Confidence | What it means |
|---|---|
| exact | The advisory names your exact version. This is the one that gets an instant email. |
| range | Your version falls inside an affected range. Treated the same as exact unless the entry is unresolved. |
| name-only | A vendor post or news item mentions something in your stack with no version data. Sent as news, weekly, never as a claim that you are vulnerable. |
News items are labelled as news everywhere they appear. We will never tell you that you are vulnerable on the strength of a blog post that happened to mention Next.js.
What an alert email looks like
From VibeBeacon <alerts@vibebeacon.app>
To you@example.com
High severity: next 15.1.0 in My Coffee Shop POS
Your app My Coffee Shop POS runs next 15.1.0. A flaw in the middleware path lets a request skip authorisation checks. It is fixed in 15.2.3.
Run this
npm install next@15.2.3Same major version, so no breaking changes are expected.
Detected 4 minutes after the advisory was published.
Digests
- Daily. One email per day, sent at the hour you pick, and only if something happened.
- Weekly if that suits you better. Both are available on every app, free or paid.
- Off is a real option. Instant alerts keep working.
A digest covers what is new, what is still open, what got resolved because you upgraded, and any news items mapped to your stack. An empty week means no email.
Snooze, acknowledge, resolve
Snooze
Hides it until a date you choose, then brings it back. For when the fix has to wait until next sprint.
Acknowledge
Says you have read it. It stays on the dashboard and stays out of the digest.
Resolve
Closes it. If a later manifest still shows the affected version, it reopens rather than staying quietly wrong.
Upgrading is the normal way alerts close. The next manifest upload shows the new version, the match no longer applies, and the alert resolves itself.
Turning the volume down
- Raise the instant threshold to critical, so only the worst wakes you.
- Set the digest to weekly, or off.
- Turn news items off entirely if vendor posts are not useful to you.
- Leave dev dependencies suppressed, which is the default.
- Pause an app while you are not running it, rather than deleting it.
These live under Settings, and thresholds can be set per app once you have more than one.
Unsubscribing
Every email carries a one-click unsubscribe, in the footer and in the headers your mail client reads. Unsubscribing stops all alert email, including instant alerts, and the dashboard keeps working. Billing email is separate and cannot be turned off while you have a subscription. What we do with your address is on the privacy page.