Sources and coverage

We monitor your last uploaded inventory. We do not inspect deployments, private vendor notices or every product and package. Advisories can be delayed, missed, corrected or withdrawn. An empty alert list is not a security guarantee.

Ingestion is scheduled every 10 minutes; general product news targets hourly refreshes. Inventory matches target 30 minutes on Free and Pro, 10 minutes on Team. OSV bulk reconciliation and lifecycle checks run over longer cycles; package catch-up queries run during ingestion. Publisher delays, rate limits and outages can extend these times. See actual refresh attempts and successes.

Structured advisories supply version ranges. Publisher and industry articles are context: mentioning a service does not prove every customer is affected. News aims to cover security, breaking changes, deprecations and major releases. Follow source links for the complete notice. Dashboard community discovery also uses HN Search, cached for 10 minutes. HN activity measures discussion, not confirmed impact.

OSV records identified as malicious packages receive high review priority when no severity is supplied. This is our prioritisation policy, not an upstream CVSS rating. OpenSSL matching supports explicit numeric version ranges; older letter-suffix versions need manual review.