# Backportal

> Backportal tracks security advisories for open-source server software, tells you which of your versions are affected, and publishes the checks and backported patches for older version lines as open code you run yourself. Free for engineers.

Every advisory page has three machine-readable twins at the same address: `.json` (all fields), `.vex.json` (OpenVEX statements per version line), and `.md` (the page as Markdown). Verdicts use the VEX vocabulary: fixed, affected, no fix on this line, under investigation. Each page states whether upgrading remediates or whether persisted state needs repair.

## Tools

- [Gitea](https://backportal.dev/tools/gitea): Lightweight self-hosted Git service written in Go.
- [GitLab](https://backportal.dev/tools/gitlab): Source hosting, CI and DevSecOps platform. Community Edition is open source.
- [Apache ActiveMQ](https://backportal.dev/tools/activemq): Message broker (Classic and Artemis) widely embedded in enterprise Java stacks.
- [Apache Tomcat](https://backportal.dev/tools/tomcat): Java servlet container behind a large share of self-hosted Java applications.
- [Metabase](https://backportal.dev/tools/metabase): Self-hosted business intelligence connected directly to production databases.
- [Langflow](https://backportal.dev/tools/langflow): Visual builder for AI agents and flows, often exposed to the network by default.
- [n8n](https://backportal.dev/tools/n8n): Workflow automation platform, self-hosted, holding credentials to everything it connects.
- [Drupal](https://backportal.dev/tools/drupal): Content management system with a large installed base in the public sector.
- [WordPress](https://backportal.dev/tools/wordpress): The most deployed content management system; core advisories only, not plugins.
- [Keycloak](https://backportal.dev/tools/keycloak): Open-source identity and access management server.

## Advisories

- None published yet. The first ones land with the first covered tools. Every advisory will name the upstream maintainers as the source of the flaw and the fix, give a verdict per version line, and ship JSON, OpenVEX and Markdown twins.

## Other

- [What is VEX](https://backportal.dev/vex)
- [Sample patch record](https://backportal.dev/report/sample)
- [Tools, coming soon, ask for yours](https://backportal.dev/tools)
- [Atom feed](https://backportal.dev/feed.xml)
- [About and contact](https://backportal.dev/about)