Did today’s CISA KEV hit my lockfiles?

DepKEV watches the CISA KEV catalog and intersects new CVEs with packages in your committed lockfiles and SBOMs, then posts a Slack alert only on hits.

How is DepKEV different from Snyk or Dependabot?

DepKEV answers one question: did today’s KEV hit my deps. It is not a full SCA platform or auto-PR bot.

DepKEV · AppSec Slack bot

Did today’s CISA KEV hit your lockfiles?

We watch the KEV catalog and ping Slack only when a new exploited CVE matches packages in your committed lockfiles or SBOMs. Not another SCA firehose.

$99/mo prepaid pilot

KEV feed → OSV/GHSA → your lockfiles
Slack on hit (repo, package, CVE, link)
No auto-PRs. Signal only.

Or email claudio.moletta@silentgrid.com

FAQ

How do you validate? One evening: current KEV × three lockfiles → hit table. Then five prepaid asks.

Who is this for? AppSec/platform with npm, pip, or Go lockfiles who care about KEV day, not every CVE.