Toolbox
vulnwatch
A daily vulnerability check for your Mac that never tells anyone what you run.
Backstory
91,681
vulnerabilities published since January 1, 2026, compared with 48,150 in all of 2025
23.43%
of the vulnerabilities exploited in the first half of 2026 were already under attack on the day the CVE came out, or earlier
284
already-exploited vulnerabilities added to CISA’s catalog this year, compared with 245 in all of 2025
At the end of October a flaw in the Brotli library came out, and Brotli sits inside Node.js and Bun. On my Mac I found three copies of Node, all vulnerable, plus one of Bun. Keeping up by hand is not realistic, and the usual shortcut, sending your package list to a scanning service, hands a third party the map of what is out of date on your computer. That’s how vulnwatch started.
What it’s for
Know what to update, every morning
What is affected, the fix and, for Homebrew formulae and global npm packages, the exact command to apply it.
The sources don’t know what you run
The vulnerability sources get the same requests from everyone, and the matching stays on your Mac.
Upgrades audited first
Every upgrade goes through an audit before it is applied.
How it works
Where the data goes
The whole check on your Mac
It downloads the same public data everyone gets.
Public data
cve.now · CISA KEV · CVE records · OSV
Your Mac
matched locally · upgrades audited first
You
report at 07:30 · vulnwatch apply <id>
Diagram from the vulnwatch README
The whole check on your Mac. It downloads the same public data everyone gets. 1. Public data (cve.now · CISA KEV · CVE records · OSV), then “the same for everyone”; 2. Your Mac (matched locally · upgrades audited first), then “report and notification”; 3. You (report at 07:30 · vulnwatch apply <id>). From step 2 back to step 1: “nothing from your Mac goes back.” Diagram from the vulnwatch README.
It starts in shadow mode: it reports, and never changes anything on its own until you turn on automatic upgrades.