The incpiration came from the "this is fine" dog sipping coffee in a burning room. That's what security news feels like these days.
pwned.coffee is my attempt at the short list, not the full CVE catalogue. Every hour it reads CISA KEV, critical GitHub security advisories, CVE records, vendor advisories and security news, and turns each incident into a kitchen ticket:
• 86'd: no fix yet
• Order up: a fix is out
• Half-poured: fixed on some release lines, not others
• On hold: nobody has named a fix yet
Each ticket has one plain "Do" line, the fixed version for each release line, and its sources.
Ways to use it, no account:
→ Drop a lockfile on pwned.coffee/protect (npm, Yarn, pnpm, pip, Poetry, uv, Go, Cargo, Composer, Bundler, Dockerfiles and workflows). It's read in memory to answer that one request; we don't store it.
→ For coding agents: a read-only MCP server at pwned.coffee/mcp with six tools (check_repo, check_lockfile, lookup_cve, todays_specials, whats_new, diff_since).
→ Email alerts if you want them: new critical incidents, filtered to your stack.
The space is a bit of a mess so get some tickets wrong. Anyone can report a wrong entry on any ticket and it goes to a public GitHub issue, and every correction is public with its source.
It's free, and it's not security advice: the vendor advisory linked on each ticket wins. What would make you open it every morning?
About pwned.coffee on Product Hunt
“A live board of security flaws”
pwned.coffee launched on Product Hunt on November 6th, 2026 and earned 70 upvotes and 1 comments, placing #29 on the daily leaderboard. A live board of security flaws and incidents, brewed hourly, with one plain line on what to do now.
On the analytics side, pwned.coffee competes within Developer Tools, Artificial Intelligence, GitHub and Security — topics that collectively have 1.1M followers on Product Hunt. The dashboard above tracks how pwned.coffee performed against the three products that launched closest to it on the same day.
Who hunted pwned.coffee?
pwned.coffee was hunted by Alex. A “hunter” on Product Hunt is the community member who submits a product to the platform — uploading the images, the link, and tagging the makers behind it. Hunters typically write the first comment explaining why a product is worth attention, and their followers are notified the moment they post. Around 79% of featured launches on Product Hunt are self-hunted by their makers, but a well-known hunter still acts as a signal of quality to the rest of the community. See the full all-time top hunters leaderboard to discover who is shaping the Product Hunt ecosystem.
For a complete overview of pwned.coffee including community comment highlights and product details, visit the product overview.
Alex
👋 Product Hunt!
The incpiration came from the "this is fine" dog sipping coffee in a burning room. That's what security news feels like these days.
pwned.coffee is my attempt at the short list, not the full CVE catalogue. Every hour it reads CISA KEV, critical GitHub security advisories, CVE records, vendor advisories and security news, and turns each incident into a kitchen ticket:
• 86'd: no fix yet
• Order up: a fix is out
• Half-poured: fixed on some release lines, not others
• On hold: nobody has named a fix yet
Each ticket has one plain "Do" line, the fixed version for each release line, and its sources.
Ways to use it, no account:
→ Drop a lockfile on pwned.coffee/protect (npm, Yarn, pnpm, pip, Poetry, uv, Go, Cargo, Composer, Bundler, Dockerfiles and workflows). It's read in memory to answer that one request; we don't store it.
→ From a terminal or CI: curl -sS -F f=@package-lock.json "https://pwned.coffee/api/check?fail=1" answers 422 if something's affected, 200 if clean. Or use the GitHub Action: pwned-coffee/check-action.
→ For coding agents: a read-only MCP server at pwned.coffee/mcp with six tools (check_repo, check_lockfile, lookup_cve, todays_specials, whats_new, diff_since).
claude mcp add --transport http pwned-coffee https://pwned.coffee/mcp
→ Look up any CVE or GHSA id at pwned.coffee/cve/<id>
→ Email alerts if you want them: new critical incidents, filtered to your stack.
The space is a bit of a mess so get some tickets wrong. Anyone can report a wrong entry on any ticket and it goes to a public GitHub issue, and every correction is public with its source.
It's free, and it's not security advice: the vendor advisory linked on each ticket wins. What would make you open it every morning?