Roadmap

What we're building, in order. There are no dates, because we would rather ship than guess, and priorities can change with what users tell us.

Available today

Already in the product.

  • Stack detection from a URL

    In beta. Strongest on WordPress and server-rendered sites.

  • Hourly CVE monitoring

    Against CVE.org, CISA KEV, and FIRST EPSS.

  • Ranking by real risk

    Actively exploited CVEs first, then CVSS and EPSS.

  • Email alerts

    With their own minimum severity.

  • Team access

    Invite teammates to see and act on alerts.

  • Search CVEs on demand

    Once a day per site, on top of the hourly checks.

  • Fair plan limits

    Over your plan's limit, extra sites are paused, and you choose which ones.

  • Coding agents over MCP

    Claude Code can read alerts, fix them, and mark them resolved.

  • Bulk add from your coding agent

    Agents can add many sites at once and record exact library versions from your lockfiles.

Building now

The current focus.

  • Automatic re-detection

    Your stack is re-checked daily, so new software is watched without you asking.

  • Daily digest and exploited-only mode

    One summary a day, or only the alerts attackers are already using.

  • Slack, Teams, and webhook alerts

    Each channel with its own minimum severity.

  • Bulk add in the app, and client labels

    Paste a list of URLs, and group sites by client. Coding agents can already bulk add.

  • What we could not see

    A clear note when a site hides libraries from us, so a quiet inbox is never mistaken for a clean bill of health.

Next

Planned after that.

  • Lockfile and SBOM upload

    Upload package.json, a lockfile, or an SBOM in the app. Coding agents can already record exact versions.

  • Better JavaScript detection

    Read library versions from your public script files by their content.

  • Client reports

    White-label PDF reports and an alert history export.

  • Email sign-in

    For people who don't use GitHub.

  • Plain-English alerts

    What happened, what to do, and a fix prompt to paste into your coding tool.

  • Link a site to its repository

    So coding agents fix alerts in the right codebase.

  • Jira and Linear

    Turn an alert into a ticket.

Later

Ideas we expect to get to.

  • Single-page app rendering

    Optional browser rendering for sites that show nothing without JavaScript.

  • WordPress connector

    Exact plugin versions, if agencies ask for it.

  • Time-to-fix metrics

    Evidence for insurers and auditors.

What we won't build

  • Active scanning

    We will not probe, attack, or stress your site.

  • Exploitability guarantees

    We can't see your code paths from outside, so we won't claim to.