Launching today
pwned.coffee
A live board of security flaws
13 followers
A live board of security flaws
13 followers
A live board of security flaws and incidents, brewed hourly, with one plain line on what to do now. Each ticket is sorted like a coffee kitchen: 86'd (no fix yet), Order up (fix out), Half-poured (some release lines fixed). You get the fixed version per release line, with sources. Check a lockfile or repo at pwned.coffee/protect, or plug the read-only MCP server into your coding agent. Free, no account.
Free
Launch Team
CloudflareDeploy serverless functions globally in seconds
Promoted
👋 Product Hunt!
The incpiration came from the "this is fine" dog sipping coffee in a burning room. That's what security news feels like these days.
pwned.coffee is my attempt at the short list, not the full CVE catalogue. Every hour it reads CISA KEV, critical GitHub security advisories, CVE records, vendor advisories and security news, and turns each incident into a kitchen ticket:
• 86'd: no fix yet
• Order up: a fix is out
• Half-poured: fixed on some release lines, not others
• On hold: nobody has named a fix yet
Each ticket has one plain "Do" line, the fixed version for each release line, and its sources.
Ways to use it, no account:
→ Drop a lockfile on pwned.coffee/protect (npm, Yarn, pnpm, pip, Poetry, uv, Go, Cargo, Composer, Bundler, Dockerfiles and workflows). It's read in memory to answer that one request; we don't store it.
→ From a terminal or CI: curl -sS -F f=@package-lock.json "https://pwned.coffee/api/check?fail=1" answers 422 if something's affected, 200 if clean. Or use the GitHub Action: pwned-coffee/check-action.
→ For coding agents: a read-only MCP server at pwned.coffee/mcp with six tools (check_repo, check_lockfile, lookup_cve, todays_specials, whats_new, diff_since).
claude mcp add --transport http pwned-coffee https://pwned.coffee/mcp
→ Look up any CVE or GHSA id at pwned.coffee/cve/<id>
→ Email alerts if you want them: new critical incidents, filtered to your stack.
The space is a bit of a mess so get some tickets wrong. Anyone can report a wrong entry on any ticket and it goes to a public GitHub issue, and every correction is public with its source.
It's free, and it's not security advice: the vendor advisory linked on each ticket wins. What would make you open it every morning?