Patch Radar for Dependency CVEs

Subscribe to dependency security alerts, auto-scan your code and get a patch PR

Problem

A warning is circulating about imminent PHP RCEs with a CVSS score of 10.0, but the only source is essentially 'trust me, bro' — nobody can verify it, and small teams with no security staff can't tell if their projects are affected either way. Independent developers maintaining multiple old projects are left guessing and hoping.

Solution

Users register their language/framework/dependency versions; the service subscribes to official advisories and vulnerability feeds (CVE, GitHub Advisory, vendor channels), matches them, assesses impact, and automatically opens an upgrade patch PR or generates an upgrade checklist in authorized repos. Rumor-grade items get flagged as 'unconfirmed' with a confidence level.

Users

Indie developers, small engineering teams, freelancers maintaining legacy projects, startups without a security hire

MVP

GitHub OAuth to read dependency manifests; subscribe to GitHub Advisory and major language vendor feeds; email/IM alert on matches with affected-version notes; auto PR for simple dependency bumps; unconfirmed-rumor labeling

Revenue

Per-repo subscription, free up to 3 repos; business tier for private repos, Slack alerts and compliance report export

Why now

Supply-chain vulnerability announcements and rumors are both rising while small teams have no security budget; advisory feeds are standardized, so a solo dev can aggregate and auto-PR cheaply