Launching today
fixdossier
Dated security-fix records & evidence packs from GitHub
2 followers
Dated security-fix records & evidence packs from GitHub
2 followers
fixdossier is a zero-dependency MIT GitHub Action that collects releases, tags, GHSA advisories, Dependabot/Renovate PRs, and security commits into a dated SECURITY-RECORD.md, JSON (fixdossier/v1), and SUPPORT.md policy ahead of EU PLD (Dec 2026), CRA (Dec 2027), and enterprise security reviews. Need human sign-off & signed exports? fixdossier Pro ingests runs via GitHub Actions OIDC (zero repo secrets stored) and exports Ed25519-signed PDF + ZIP Evidence Packs.
Hi Product Hunt! I built fixdossier ahead of the revised EU Product Liability Directive (Directive (EU) 2024/2853, applicable Dec 9, 2026) and the Cyber Resilience Act (Regulation (EU) 2024/2847).
Under EU PLD (Art. 9 & 10) and CRA vulnerability-handling rules, engineering teams need a dated, verifiable record of when security issues were patched, which release shipped each fix, and what the security support window is per release. Most of that evidence already lives in GitHub—scattered across releases, tags, GHSA advisories, merged Dependabot/Renovate PRs, and commits.
What's free & open source (MIT GitHub Action — uses: itulo/fixdossier@v0):
• Runs in CI with the standard GITHUB_TOKEN (zero runtime dependencies).
• Outputs SECURITY-RECORD.md, security-record.json (schema: fixdossier/v1), and a SUPPORT.md support-period table.
• Explicitly labels how each fix was mapped to a release (advisory patched_versions, tag commit match, or date heuristic) so engineers know what needs review—especially around backports and maintenance branches.
• Real sample outputs on axios/axios, fastify/fastify, and vitejs/vite at https://fixdossier.dev.
What's in fixdossier Pro (https://app.fixdossier.dev — live interactive demo at https://app.fixdossier.dev/demo):
• Zero-secret CI uploads via short-lived GitHub Actions OIDC (pro_upload: 'true')—we never clone your code or store tokens to your private repos.
• Hosted review queue & append-only audit log (confirmed_security_fix, excluded_not_security, needs_followup).
• Draft & Final PDF summary reports plus ZIP Evidence Packs with an Ed25519-signed pack-manifest.json (SHA-256 checksums + Ed25519 signature verifiable via /api/v1/verify or offline).
• €69 one-time Founding Licence for the first 50 GitHub organizations (1 GitHub org, up to 3 repositories and 5 reviewers, 24 Final Evidence Packs/year, 60 Draft PDFs/month, 2 GB storage; active for as long as the service runs, with at least 90 days' notice and a full export if discontinued; 14-day EU refund policy).
(Disclaimer: fixdossier is an engineering tool for evidence collection and review support, not legal advice and not a compliance certificate.)
Would love your feedback and happy to answer any questions!