What you get
- The free watch. When a dependency you shipped appears in CISA's KEV catalogue or crosses an EPSS score of 0.1, a check run on the commit you shipped tells you.
- A dated record of every push. CycloneDX and SPDX SBOMs, the advisories known that day, and who confirmed what, when.
- The ENISA early-warning draft once someone confirms exploitation, with the 24-hour deadline counted from when you became aware.
- Free for one product or one public repository. Then €19 or €49 per product per month. Planned prices, ex. VAT; nothing is billed during early access.
A GitHub App with three permissions: metadata and contents read, checks write. Nothing is written to your repository. How the record works