pwned.coffee

What makes it different

Security news feels like the “this is fine” dog sipping coffee in a burning room — that is the starting point for pwned.coffee. Every hour it reads CISA’s Known Exploited Vulnerabilities catalog, critical GitHub security advisories, CVE records, vendor advisories and security news, and turns each incident into a kitchen ticket instead of a raw CVE entry.

Each ticket is sorted the way a coffee kitchen sorts orders: 86’d means no fix exists yet, Order up means a fix is out, Half-poured means only some release lines are fixed, and On hold means nobody has named a fix. Every ticket carries one plain “Do” line, the fixed version for each release line, and its sources — so a developer can act in seconds instead of reading a full advisory.

There is no account and nothing to install for the basics: drop a lockfile on pwned.coffee/protect and it is read in memory for that one request, look up any CVE or GHSA id directly, or query it from a terminal or CI — the API answers 422 when something in the lockfile is affected and 200 when it is clean. Coding agents can use the read-only MCP server, and anyone can report a wrong entry: every correction goes to a public GitHub issue with its source.