What we store

A list of developers and the vulnerable software they run is a valuable target. We treat this database as sensitive, and the honest way to say so is to tell you exactly what is in it.

What we hold

• Your email address.
• The stacks you selected.
• If you supplied dependencies: package names, ecosystems and versions. Nothing else.
• Your cadence preference, and a consent record — when you subscribed, from which page, and the IP that submitted the form. We keep this because it is what demonstrates you asked to be here.
• A log of which alerts we sent you, so we never send the same one twice.

What we never receive

• Your dependency file. It is parsed by JavaScript in your browser. Only the extracted {ecosystem, name, version} triples are sent. Open your network tab during signup and check.
• Integrity hashes, registry URLs, or anything else a lockfile carries — all stripped before sending.
• Your name, company, repository names, or paths from inside the file.
• Anything from a tracker — there are none. No analytics, no tag manager, no third-party script anywhere on this site. The only external requests are the two font files and Cloudflare Turnstile on the signup form, which stops bots using us to mailbomb people.

One thing we will not pretend away: if your dependency list includes private or internal packages, their names do reach us, because a name is what matching needs. Versions and names only — never source, never URLs — but if an internal package name is itself sensitive, remove those lines before pasting, or subscribe with stacks alone.

No account, no password

There is nothing to log into. Preference and unsubscribe links in your emails carry a signed, scope-limited token, so there is no password for anyone to steal and a forwarded alert cannot be used to read or change your settings.

Your email provider sees your alerts

Worth stating plainly: alert emails name your vulnerable packages, and they travel through our delivery provider and your mail host. If that matters for your threat model, subscribe with stacks only and leave the dependency list empty — stack alerts reveal nothing specific to you.

Deleting your data

Every email has a one-click unsubscribe, which stops all mail immediately. From the preferences page you can also erase the record outright — subscription, stacks, dependency list and send history — which is immediate and irreversible. We never sell or share the list.