CVE response
AllCVE response
Get alerted when a new CVE hits what you're running in production
How to be told when a vulnerability affects the packages your running services actually have installed: boot, change and six-hourly checks, count-only alerts, tested.
Am I affected by the Next.js and React Server Components CVEs? How to check
How to tell if your Next.js app is vulnerable to React2Shell and the October 2026 Next.js RCEs: the version ranges, why npm ls react misleads, and what to do.
50,000 CVEs a year, and under 1% on the exploited list: the numbers
NVD published about 50,000 CVEs in 2025, up from 19,000 in 2020, while CISA's exploited list grows slowly. The counts, a script to reproduce them, and their limits.
Fail your CI build on known vulnerable dependencies (no account needed)
Add one step to GitHub Actions or GitLab CI that fails the build on known vulnerable dependencies, with thresholds, JSON gating and what leaves your runner. Tested.
How to respond to a critical CVE when you have no security team
A five-question decision tree and time boxes for a small team: is it exploited, do you run it, is it reachable, can you fix it, and how to prove the fix landed.
Too many Dependabot alerts? Triage by what actually runs
A triage method for Dependabot alert overload: use GitHub's free filters, group by package, then check what is exploited, reachable and actually deployed. Tested script.