How it works
From repo to alert. Without you having to search.
Stackwatch connects three things that are separate today: precise knowledge of what runs in your stack, real-time monitoring of every source, and escalation that gets through at night, too.
Step 01
Connect
You connect GitHub via OAuth and pick the repos we should watch. We only get read access to the contents and metadata of those repos. No write access, no issues, no pull requests. You are done in two minutes.
Which permissions we need and which we do notStep 02
Map your stack
We read Dockerfiles, lockfiles, CI and infra configs and build your stack map from them: runtimes, frameworks, packages, servers, providers. Every entry comes with the detected version, a confidence level and the evidence, meaning the file and line we got the information from.
- Runtime versions like PHP, Node.js or Python, not just packages
- Web servers, base images and providers from infra and CI configs
- Every entry with evidence, so you can see where it comes from
| Component | Evidence | Confidence |
|---|---|---|
| RuntimePHP 8.3.35 | Dockerfile:3 | high |
| Web servernginx 1.27.4 | docker-compose.yml:12 | high |
| FrameworkLaravel 11.44.2 | composer.lock | high |
| Base imagedebian bookworm | Dockerfile:1 | high |
| Packageguzzlehttp/guzzle 7.9.3 | composer.lock | high |
| ProviderHetzner Cloud | infra/main.tf:4 | medium |
Step 03
Watch in real time
We check vendor feeds and advisory databases every minute. On top of that come security research and social signals, because that is where vulnerabilities often surface hours before the CVE. An AI classifies every signal: which component, which versions, how critical, is there an active exploit, is it confirmed or a rumor?
Social signals are hints, not facts. An alert only counts as confirmed once a primary source backs it. We label rumors as rumors.
Signal on social media02:41
flagged as rumor
Primary source confirmed03:07
vendor advisory published
Matched against your stack map03:09
3 systems affected
Alert and call03:09
acknowledged after escalation
Patch detected04:02
verified automatically
Vendor feeds
php.net, nodejs.org, framework releases
Advisory databases
GitHub Advisories, OSV, NVD, CISA KEV
Distributions
Debian, Ubuntu, RHEL, Alpine
Security research
Blogs of leading research teams
Social signals
Hacker News, Reddit, Mastodon, Bluesky, X
Supply chain
Compromised packages, provider breaches
Step 04
Alert, fix, verify
We match every signal against your stack map. Only if your version and your usage are affected do you get an alert in Slack, Teams, by email or SMS. With what you need right now: which systems are affected, where the version is defined and what the fix looks like for your configuration.
- Only high and critical issues with a real version match trigger an alert
- Everything else arrives bundled in the weekly digest
- After the patch, we verify automatically
PHP2Shell hits 3 of your systems
- api-backendPHP 8.3.35Dockerfile:3
- billing-servicePHP 8.3.35docker/php/Dockerfile:1
- admin-portalPHP 8.3.21.github/workflows/deploy.yml:18
Fix: PHP 8.3.36
Timeline
- 02:41First signal
- 03:07Confirmed
- 03:09Alert to you
Escalation up to a phone call
For critical issues with an active exploit, a message is not enough. An AI agent calls you, reads you the vulnerability and the immediate action, and you acknowledge with key 1. No response within five minutes: the agent calls the next person in the chain. At night and on weekends, too.
Incoming call
Stackwatch alert agent
Agent: This is Stackwatch with a critical alert. PHP2Shell, actively exploited, affects api-backend and two other systems.
Agent: Immediate action: update PHP to 8.3.36. Press 1 to acknowledge this alert.
You: Key 1
Agent: Thank you. Acknowledged at 03:16, recorded in the audit log.
Verification and audit log
After the patch, we automatically check whether the new version has landed in your repo. Every alert, every acknowledgement and every status change is recorded with timestamp and person in the audit log, exportable as CSV and PDF.
| Time | Event | Person |
|---|---|---|
| 03:09:42 | Alert triggeredSystem | System |
| 03:14:50 | Call, no responseJ. Becker | J. Becker |
| 03:14:51 | Escalated to next personSystem | System |
| 03:16:08 | Acknowledged via key 1M. Weber | M. Weber |
| 04:02:17 | Patch verifiedSystem | System |
Ready when the next vulnerability hits?
Join the waitlist. We will get in touch personally as soon as the beta starts.
Join the waitlist