I used to hear about CVEs in our stack the same way everyone else did, from Twitter and HN, usually a couple of days after the advisory went up. This is the setup I use now to get a Slack message the day a new CVE lands for a package we actually run.

The one that changed my mind came through a quote tweet. Someone posted a screenshot of an advisory, the replies were already in the hundreds, and an HN thread was climbing. The advisory had been public for two days. We had the affected library in production the entire time.

It wasn't hidden. It was on a public page that nobody on our team was reading.

So I made the pages read themselves. When something new shows up for a package on our list, a short line lands in #security with the package, the affected versions and a link.

The pages I watch

All of them are public, and they fall into three groups.

NVD searches. One per product. The NVD results page has a stable URL, so a search like nvd.nist.gov/vuln/search/results?form_type=Basic&results_type=overview&query=openssl&search_type=all works as a watch target. Change openssl to whatever you run.

GitHub Advisory Database searches. For open source packages this is often quicker than NVD, and the ecosystem filter cuts a lot of noise. I use searches like github.com/advisories?query=ecosystem%3Apip+django and github.com/advisories?query=ecosystem%3Anpm+next.

Vendor security pages. OpenSSL keeps openssl.org/news/vulnerabilities.html. Django has a security archive at docs.djangoproject.com/en/dev/releases/security/. Next.js posts at github.com/vercel/next.js/security/advisories. These tend to be the clearest about which versions are hit and what to move to.

Not every package gets all three. The handful that would really hurt (web framework, TLS library, auth library, database driver) get the vendor page plus a GitHub search. Everything else gets a single GitHub search.

Keywords didn't work for me

My first try was a feed of all new CVEs with a keyword filter. "openssl" matched hundreds of products that ship it inside something else. "next" matched nearly everything. I muted the channel within a week.

What stuck was describing our stack in a sentence and letting the watch judge each new entry against it.

Alert me when a new advisory or CVE is added for Django 4.2 or 5.x. Include the CVE ID, severity, affected versions and fixed version in two sentences. Ignore advisories for other packages, edits to old entries and page layout changes.

Vendor pages need less.

Alert me when a new vulnerability is listed on this page. Name the CVE ID and the affected OpenSSL versions.

For packages with no decent advisory page, I write a topic instead, something like "new CVEs affecting OpenSSL 3.x". It's looser than watching a page, so I keep it as a fallback.

Who sees it and what they do

The alerts go to a small #security channel with the people who'd do the patching. A typical one reads like this.

New advisory for openssl. CVE-2026-XXXXX, high severity, affects 3.0 through 3.3, fixed in 3.3.2. Link in thread.

The owner of that part of the stack answers in the thread with one word. "n/a" if we're not on an affected version, "patch" if it goes in this week, "now" if it can't wait. Most get "n/a". What matters is that somebody looked on day one and said so in public.

What I'd tell you before you set this up

  • Only watch what you run. Watching "all of security" is how the channel dies.
  • Daily is plenty. Advisory pages don't move by the hour, and 9 AM is still well ahead of the HN thread.
  • Update the watch list when the stack changes. New dependency, new watch. Removed dependency, removed watch.
  • This is not a vulnerability scanner. It reads public pages and reports new entries. It doesn't read your lockfile, build an SBOM or patch anything, so keep Dependabot or whatever scanner you already run.
  • The CISA KEV catalog and your cloud provider's security bulletins are different problems. I watch those separately.

What I use

I run this on AyeWatch. I can point it at a public page or give it a topic sentence, say in plain English what counts as a new entry, and get a short summary instead of a diff. There's a Free Preview, and Pro is $9/month, which is the plan that posts to Slack. Any page monitor that summarizes changes and pushes to Slack would work.

I want this to be boring. The next CVE on our stack should be a Slack line someone answers "n/a" to over coffee, before anyone has opened the HN thread.