CVE Alerts

CVE alerts tell you when a newly published advisory affects a dependency that one of your monitored companies uses, without waiting for the next audit. They answer one question early: which of our companies ships this package, and which version?

CVE alerts cover the companies enrolled in Portfolio Monitoring. A one-off audit started from Create New Audit never produces alerts, because the company is not monitored. Alerts are on for every monitored company; each person decides for themselves whether to also get email.

How the six-hour cycle works#

Every six hours CodeDD fetches the advisories that were published or changed since the last check, compares them with what each monitored company depends on, and turns the matches that matter into alerts. Emails follow on their own schedule.

All times are UTC.

The first time the feed runs, CodeDD only records the current state of each ecosystem. It does not alert on advisories that already existed, so you are never flooded with old findings.

An example#

An advisory affecting a package that one of your companies pins is published at 09:10. The 12:25 pass reads it, finds the match and creates the alert, which shows on the bell in My Portfolio a few minutes later. If you turned email on, it is in the daily digest at 07:05 the next morning. If the advisory is also known to be exploited, it goes out at the next 6-hourly email pass (12:50 in this example) instead of waiting for the digest.

What is checked#

The dependency inventory. CodeDD matches advisories against the dependencies it last checked for each company: the ones found by the latest audit, refreshed by the monthly pulse. Every alert shows the date of that check ("as of Sep 30") and says the dependency is affected as of that check, never that it is vulnerable right now. A dependency added after the last check appears at the next pulse or audit.

How exactly a version is known. Only precise matches alert:

Dependencies that a repository declares but never imports in code still alert, but they are labelled as such and ranked below the ones that code imports.

When an advisory becomes an alert#

An advisory creates an alert for a company when all of these hold:

1. The company's version is affected (an exact match, as above).
2. The advisory is Critical or High: rated Critical, or CVSS 9.0 or higher for Critical; rated High, or CVSS 7.0 or higher for High. An advisory with no rating yet alerts through its CVSS score only.
3. The advisory is new to the company: the last audit or pulse had not already counted it, and it was not part of the first catch-up of an ecosystem.
4. It is a vulnerability advisory, not a malicious-package record.

There are three triggers:

One alert per advisory per company. The same advisory often appears under several names (a CVE, a GitHub advisory, an ecosystem ID). CodeDD merges them into one alert and shows the CVE ID when there is one. If the match comes back later (a withdrawal is reversed, or the company returns to an affected version) the alert reopens.

Alerts close by themselves. An alert closes when the advisory is withdrawn, or when a later evaluation no longer finds the company affected. Exploited alerts are re-checked in every cycle against the company's newest check; for the others, the alert follows the advisory, so an upgrade you make is reflected when CodeDD next re-evaluates that advisory.

Where you see alerts in the app#

On My Portfolio, the shield icon at the top is the alert bell:

• Its badge counts the advisories with an alert you have not seen yet. Opening the bell shows the five worst, and Open all in CVEs lists every one with its drawer: the companies, repositories, versions, whether the code imports the package, and the fix.
• A severity filter at the foot of the bell and in the CVEs view chooses what the badge and lists show. The default is Critical; Critical + High adds High advisories.
• An alert counts as new for 30 days and stays in the open list for 180 days, until it closes.

The bell appears for fund administrators, for the monitored companies they can open.

Email#

Email is opt-in and personal: nobody receives CVE emails until they choose to, and nobody can switch it on for someone else.

Open the bell, choose Email settings (or use the CVE emails chip on a company dashboard), and set:

The settings cover the monitored companies you get in-app alerts for as a fund administrator, plus the monitored companies where you are an initiator or reviewer (a submitter, only when the company shares remediation access). Companies without Portfolio Monitoring are never in scope.

What you receive:

• One digest a day (about 07:05 UTC) with every new alert from the last three days that was not emailed to you yet. No alerts, no email.
• Known-exploited advisories go out at the next 6-hourly pass instead of waiting for the digest.
• No backlog: turning email on, or raising the level to High, sends nothing from before that moment.
• Each advisory appears once per notification. The email lists the affected companies, where the package is used, the fix and the date of the check, and links to the CVEs view.
• Every email has an unsubscribe link that needs no sign-in. It switches your whole CVE email setting off, including the extra addresses.

What CVE alerts do not tell you#

• Whether the vulnerable code runs. An alert counts files that import the package, not calls of the vulnerable function.
• Anything newer than the last check. A dependency added or changed since the last pulse or audit is not known yet.
• Exposure you add later. An alert is about a new advisory. If a company adds a package that already has a known vulnerability, the finding shows in the company's CVE results after the next pulse or audit, not as an alert.
• Advisories OSV does not carry yet. An advisory can only alert after it is published there; the six-hour cycle adds at most six hours.
• Ecosystems outside the six listed. Other package managers are still covered by the audit and monthly pulse, not by the six-hourly feed.

Frequently asked questions#

Why did I not get an alert for a package one of my companies uses?#

Check these in order: the company is enrolled in Portfolio Monitoring; the advisory is Critical or High (or became so); the version CodeDD has is pinned (a ranged version is a possible match and never alerts); the advisory was not already counted by the last audit or pulse; the dependency was not added to the company after the advisory was published (that shows in the company's CVE results instead); and the package is in one of the six ecosystems.

Why did the badge change but I got no email?#

The badge is in-app and immediate. Email goes in the daily digest, or at the next 6-hourly pass when the advisory is known to be exploited. Also check that your level is not Off and that the alert is at or above your level.

Why does an alert say "as of" an earlier date?#

The match uses the dependencies of the company's last audit or pulse. The date is the check it is based on, so you can tell how fresh the evidence is.

Can a colleague turn email on for me?#

No. The setting belongs to your account. Administrators can see alerts in the app but cannot subscribe someone else.

Can I send alerts to a shared mailbox?#

Yes, if it is on your own email domain: add it as an extra address. Addresses on other domains are not accepted.

Do one-off audits get alerts?#

No. Only companies enrolled in Portfolio Monitoring are monitored for new advisories.

Next steps#

• Portfolio Monitoring
• Team Members & Access Roles
• Setting Up a Portfolio Organization