The incpiration came from the "this is fine" dog sipping coffee in a burning room. That's what security news feels like these days.
pwned.coffee is my attempt at the short list, not the full CVE catalogue. Every hour it reads CISA KEV, critical GitHub security advisories, CVE records, vendor advisories and security news, and turns each incident into a kitchen ticket:
• 86'd: no fix yet
• Order up: a fix is out
• Half-poured: fixed on some release lines, not others
• On hold: nobody has named a fix yet
Each ticket has one plain "Do" line, the fixed version for each release line, and its sources.
Ways to use it, no account:
→ Drop a lockfile on pwned.coffee/protect (npm, Yarn, pnpm, pip, Poetry, uv, Go, Cargo, Composer, Bundler, Dockerfiles and workflows). It's read in memory to answer that one request; we don't store it.
→ For coding agents: a read-only MCP server at pwned.coffee/mcp with six tools (check_repo, check_lockfile, lookup_cve, todays_specials, whats_new, diff_since).
→ Email alerts if you want them: new critical incidents, filtered to your stack.
The space is a bit of a mess so get some tickets wrong. Anyone can report a wrong entry on any ticket and it goes to a public GitHub issue, and every correction is public with its source.
It's free, and it's not security advice: the vendor advisory linked on each ticket wins. What would make you open it every morning?
No comment highlights available yet. Please check back later!
About pwned.coffee on Product Hunt
“A live board of security flaws”
pwned.coffee launched on Product Hunt on November 6th, 2026 and earned 70 upvotes and 1 comments, placing #29 on the daily leaderboard. A live board of security flaws and incidents, brewed hourly, with one plain line on what to do now.
pwned.coffee was featured in Developer Tools (522.6k followers), Artificial Intelligence (483k followers), GitHub (41.5k followers) and Security (3k followers) on Product Hunt. Together, these topics include over 267.9k products, making this a competitive space to launch in.
Who hunted pwned.coffee?
pwned.coffee was hunted by Alex. A “hunter” on Product Hunt is the community member who submits a product to the platform — uploading the images, the link, and tagging the makers behind it. Hunters typically write the first comment explaining why a product is worth attention, and their followers are notified the moment they post. Around 79% of featured launches on Product Hunt are self-hunted by their makers, but a well-known hunter still acts as a signal of quality to the rest of the community. See the full all-time top hunters leaderboard to discover who is shaping the Product Hunt ecosystem.
Want to see how pwned.coffee stacked up against nearby launches in real time? Check out the live launch dashboard for upvote speed charts, proximity comparisons, and more analytics.
Alex
👋 Product Hunt!
The incpiration came from the "this is fine" dog sipping coffee in a burning room. That's what security news feels like these days.
pwned.coffee is my attempt at the short list, not the full CVE catalogue. Every hour it reads CISA KEV, critical GitHub security advisories, CVE records, vendor advisories and security news, and turns each incident into a kitchen ticket:
• 86'd: no fix yet
• Order up: a fix is out
• Half-poured: fixed on some release lines, not others
• On hold: nobody has named a fix yet
Each ticket has one plain "Do" line, the fixed version for each release line, and its sources.
Ways to use it, no account:
→ Drop a lockfile on pwned.coffee/protect (npm, Yarn, pnpm, pip, Poetry, uv, Go, Cargo, Composer, Bundler, Dockerfiles and workflows). It's read in memory to answer that one request; we don't store it.
→ From a terminal or CI: curl -sS -F f=@package-lock.json "https://pwned.coffee/api/check?fail=1" answers 422 if something's affected, 200 if clean. Or use the GitHub Action: pwned-coffee/check-action.
→ For coding agents: a read-only MCP server at pwned.coffee/mcp with six tools (check_repo, check_lockfile, lookup_cve, todays_specials, whats_new, diff_since).
claude mcp add --transport http pwned-coffee https://pwned.coffee/mcp
→ Look up any CVE or GHSA id at pwned.coffee/cve/<id>
→ Email alerts if you want them: new critical incidents, filtered to your stack.
The space is a bit of a mess so get some tickets wrong. Anyone can report a wrong entry on any ticket and it goes to a public GitHub issue, and every correction is public with its source.
It's free, and it's not security advice: the vendor advisory linked on each ticket wins. What would make you open it every morning?