When the next CVE drops, you will know in 5 minutes if you are affected and exactly how to mitigate it.

Continuous CVE feed matched to YOUR stack

Most tools tell you a CVE exists. We tell you whether your servers' actual installed packages, kernel, and Docker images are affected, with specific version checks. NVD + Ubuntu USN + Debian DSA + Red Hat RHSA + GitHub Advisories all watched continuously.

Ranked by what's actually being exploited

Every match is cross-referenced against CISA KEV (the actively-exploited-in-the-wild catalog) and FIRST EPSS (probability of exploitation in the next 30 days). KEV hits are flagged 'actively exploited', sorted to the top, and ransomware-linked ones are called out separately — so a wall of 40 CVEs becomes 'patch these 3 tonight.' This is the prioritization enterprise scanners gate behind a sales call, and it runs on the free scan.

Specific recommended action, not a threat score

When a CVE matches, you get the exact command to run, the modprobe blacklist syntax, the apt package version to upgrade to, the docker pull tag — not 'review and assess severity.' Optional auto-apply with explicit per-CVE approval and a full audit log.

Audit log your own customers can see

Every alert, every mitigation, every kernel update — timestamped and exportable. Hand your enterprise prospects a private signed link to your security-response posture instead of an emailed PDF that goes stale in a week.

SSH read-only or lightweight agent

Trust model is your choice. SSH read-only means we connect with your public key on our schedule. Agent install means a small read-only systemd service on your box pushes inventory to us. Both options ship with the V1 MVP. Both can be revoked instantly.

Split every finding into 'in-use — patch now' and 'dormant — installed but nothing loads it,' so a 40-CVE wall collapses to the few that touch live traffic. The reachability filtering Sysdig and Snyk gate behind a sales call.

Auto-updates skip reboot-required kernel CVEs and silently hold packages. We surface exactly which actively-exploited (KEV) CVEs are stuck pending-reboot or held back right now — the blind spot most founders assume is covered.

Every CVE tagged: fixable live, needs a reboot, or a normal apt upgrade. For kernel ones we point you at free Ubuntu Pro Livepatch (free for ≤5 machines) or schedule the reboot — so 'will this need downtime?' is answered before you act.

Most self-hosters run their whole stack in Docker on one box. We match the packages inside your running images with the same matcher we use on the host, then hand you the exact docker pull tag — bundled, no separate license.

A per-CVE timeline — discovered, prioritized, fixed, re-scanned-and-confirmed — mapped to SOC 2 CC7.1/CC7.2, plus an auto-filled one-page vuln-management policy. The artifact that clears the security questionnaire blocking your enterprise deal.

CVE feeds are blind to malware. 454,600+ malicious open-source packages shipped in 2025 (99%+ npm), plus AI "slopsquatting." We cross-check your installed npm/pip packages against malware advisories — a different threat class than CVEs.

What if I have more than 3 servers?

Solo ($9/mo) covers 3, Pro ($29/mo) covers 10, and Team ($79/mo) is unlimited servers on a flat fee — no per-box metering. Pick the plan that fits and change it anytime from the billing portal.

Do I need a card to start the trial?

No. Every paid plan starts a 14-day free trial with no card. Stripe only asks for payment before the trial ends, and you can cancel anytime in between with no charge.

Monthly or annual?

Both. Annual billing is 2 months free (Solo $90/yr, Pro $290/yr, Team $790/yr). Toggle it on the pricing table above. Cancel or switch anytime — no lock-in.

Will it work on Alpine / Rocky / AlmaLinux / RHEL?

Live as of 2026-04-30: Ubuntu + Debian + Alpine (v3.18-edge) + AlmaLinux (8/9/10) + Rocky Linux (8/9/10). Upstream RHEL paid + Amazon Linux + openSUSE on the V2 roadmap. RHEL clones map to AlmaLinux/Rocky equivalents — same patches. Free quickscan works on any supported box.

Does it auto-apply patches?

Manual by default — we give you the exact apt / kernel-reboot / modprobe one-liner and you run it. Pro and Team add optional auto-apply, and even then every CVE needs explicit per-CVE approval with a full audit log. Trust is fragile; nothing touches your box without a yes.

Refund / cancellation?

Cancel anytime from the billing portal — you keep access through the period you paid for. Charged by mistake? Reply to your Stripe receipt or email agents@mindsparkstack.com and the refund clears within 24h.

What about Ubuntu Pro / ESM CVEs?

We flag them with the apt_upgrade_esm playbook class — including the explanation that the fixed version is in Ubuntu Pro (free for personal + small-team use) and a one-liner to attach a Pro token. Playbook reference.