Security patches for self-hosted open source, backported in hours, free for engineers.
Your fork, patched to upstream. With proof.
- free with your own model key
- open source, runs on your side
- nothing of yours touches us
The process
Notified, verified, patched and proven. In hours, not weeks.
One advisory, six steps, one record at the end. Watch it run.
- T+0
Notify
Advisory matched to your declared stack.
alert - T+3 min
Assess
Version and configuration, with exposure context.
check - T+9 min
Verify
Vulnerable condition confirmed reachable. No attack.
exploitability check - T+1 h 38
Patch
Upstream fix backported to your line, built, tested.
patch - T+1 h 56
Hunt
Indicators searched across the exposure window, with you.
hunt · paid - T+2 h 00
Prove
Every step timestamped and signed.
record
- T+0advisory matched to your stack: 3 instances declared
- T+3 minassessed: 2 affected, 1 not affected (internal, feature disabled)
- T+9 minverified: vulnerable condition reachable on 2 instances
- T+1 h 38patch built and tested for your line, applied to your fork
- T+1 h 56hunt: no indicators of exploitation in the window
- T+2 h 00record signed, VEX published. Time to patch: 2 h 00
Illustrative timings. Real records carry real timestamps, real instance names and a signature you can verify.
The record
What lands on the auditor's desk.
One advisory, your instances, six timestamped steps, verdicts, evidence and a signature. Readable by a human as a post-mortem, by a machine as VEX, by an auditor as proof.
| app-eu-1 | 1.6.9 | internet-facing | affected | patched 10:40Z |
| app-us-1 | 1.6.9 | internet-facing | affected | patched 10:40Z |
| app-internal | 1.7.5 | internal | fixed | none |
| 09:02Z | Notify | advisory matched: 3 instances |
| 09:05Z | Assess | 2 affected, 1 not affected |
| 09:11Z | Verify | reachable on 2, no attack performed |
| 10:40Z | Patch | backport built, tested, merged |
| 10:58Z | Hunt | no indicators in the window |
| 11:02Z | Prove | record signed, VEX published |
The same document, three ways: the page, the PDF your compliance lead forwards, and the JSON your tooling verifies.
Open the sample record Download the PDF
Sample data with placeholder names. The flaw and the fix in a real record belong to the upstream maintainers and are credited as such. Real records carry real names, real hashes and a signature you can verify.
Free
What is free?
Five of the six steps, when they run on your side with your own model key. The hunt is the exception: it needs your logs and your state, so it is paid and done with you. Roll through step by step, or compare everything at once.
- Notify Alerts by email for the stack you declared, with the artifacts attached. Alerts into your channels, matched to your fleet, with a response-time commitment.
Notify, assess, verify, patch, prove: free with your own model key. The hunt, and anything run by us: paid.
Who is this for?
People who own the window between an advisory and the upgrade they cannot do today.
Platform and DevOps engineersyou own the patch window
You run open-source server software yourselves and the patch window is your problem, not a vendor's. You want the verdict at 9 a.m. and the patch before lunch, without handing anyone the keys.
Teams on forks and custom buildsevery upgrade is a project
Extensions, themes, plugins, a cherry-pick or two. Every upgrade is a project, so you stay one or two lines behind and live with the risk. You should not have to.
Hosters and managed service providersone process, one record per customer
Many instances of the same tool for many customers. You need one process, one clock, and one record per customer to hand over when they ask.
Security and compliance leadsprove it happened, and how fast
You do not run the patch, you have to prove it happened and how fast. Signed records and time-to-patch reports answer the questionnaire before the meeting.
Not for you if
You always run the latest release the day it ships, or you consume the tool as a managed service. Upstream, or your vendor, already covers you. Come back the day you fork.
Why now
Because the other side already automated.
Already past all of 2025. In September.
- 23% more CVE records than the whole of 2025, with four months to go
- 85% more than January to August 2025
The numbers behind itexploitation speed, machine discovery, the yearly count
of vulnerabilities exploited in the wild in 2025 were exploited on or before the day their CVE was published
an autonomous system topped HackerOne's US leaderboard in June 2025, with nearly 1,060 reports
| Year | CVE records published |
|---|---|
| 2021 | 21,950 |
| 2022 | 26,431 |
| 2023 | 30,949 |
| 2024 | 40,704 |
| 2025 | 49,972 |
| 2026 (to Sep 6) | 61,684 |
Numbers as of 2026-09-06. Counted by NVD publication date, which is not the discovery date. Sources: NVD (CVE counts by publication date), VulnCheck, State of Exploitation 2026, Mandiant, 2023 time-to-exploit trends, Google Cloud, M-Trends 2026, XBOW on HackerOne, Google, Big Sleep.
We are betting on AI against AI. Vulnerabilities are now found and weaponized at machine speed, and no engineering team can patch at that speed by hand. The only answer is a machine on the defending side. It has to be faster than the attacker, it has to prove what it did, and it should not cost your engineers their week.
Why is upgrading not the same as patching?
Upstream fixes a CVE in the newest release. You run a fork, a customized build, or a version line two minors behind because the upgrade breaks your extensions. Between the day the advisory drops and the day you can upgrade, you are exposed and you know it. Attackers now weaponize a published CVE in hours. A week is too long. A day is too long. Backportal exists for that window.
How does it work?
Six steps, each with an open artifact and a clock.
-
Notify
The advisory reaches you in minutes, matched to the tools and versions you declared.
artifact: the alert, with everything below attached -
Assess
Which of your instances are affected, from version and configuration, with your exposure context applied. An internal tool behind a VPN is not an internet-facing one.
artifact: the detection check -
Verify
A safe check confirms the vulnerable condition is reachable. It never performs the attack.
artifact: the exploitability check -
Patch
The upstream fix, backported to your version line, built and tested. On your fork as a merge request, or as a signed binary.
artifact: the patch, per version line -
Hunt
The indicators an exploit leaves behind, for the window between disclosure and patch, run against your logs and state. A paid step, done with you.
artifact: the hunt report · paid -
Prove
Every step timestamped and signed, readable as a post-mortem by a human and as a VEX statement by a machine.
artifact: the record
Who runs each step?
You, by default. Or us, on your behalf, when you ask for it in writing. That includes the exploitability check and the exploitation hunt.
The two marked steps run on your instances only when you ask in writing and name them. The hunt is always a paid step: it needs logs, state and an understanding of your deployment that no script has on its own. The record reads the same whoever ran a step.
What does "nothing of yours touches us" mean?
You decide how much to connect, and the process is the same at every level. Everything that runs on your side is open source. You can read every line before it touches a cluster.
Nothing goes back.
No code, no config, no secrets leave.
The patch arrives as a review, or as a signed build.
Same six steps at every level. More automation as trust grows, and the record is identical.
Tools
Coming soon. Yours first, if you ask.
One product line per tool, each with its own build and test harness kept warm. Tools are added by demand, and asking is how demand gets counted.
Who builds this?
European operator team · names later, work first
A European operator team that has spent years running open-source platforms in production and living with their versioning: forks, extensions, maintenance lines, the upgrade that waits. Built for teams that could not upgrade the day a CVE dropped and got tired of choosing between a broken upgrade and an open hole.
In preview and deliberately quiet. The names come out with the first customers.
Get alerts for your stack
Tell us what you run. We tell you when it matters, with the checks and patches attached.
No tracking, no newsletter. One email per advisory that matches, and a link to stop at the bottom of each. Your tool and version are stored to match advisories and for nothing else.
Tell us what you run. We'll tell you when it matters.