Live Board of Security Incidents
pwned.coffee is a free service that provides a live board of software security incidents and fixes, updated hourly. The project, created by Alex Trails, draws inspiration from the “this is fine” dog meme, aiming to offer a concise, actionable list rather than a comprehensive CVE catalogue.
How It Works
pwned.coffee aggregates information from various sources, including CISA KEV, critical GitHub security advisories, CVE records, vendor advisories, and security news every hour. Each incident is transformed into a ticket styled like a kitchen order, assigned one of four statuses:
- 86’d: No fix yet
- Order up: Fix available
- Half-poured: Fixed on some release lines but not others
- On hold: No named fix yet
Each ticket includes a straightforward “Do” line, the fixed version for each applicable release line, and sources. It is important to note that vendor advisories linked on each ticket take precedence, and the board is not intended to serve as formal security advice.
Using pwned.coffee
No account is required to access the main features. Users can upload a lockfile at pwned.coffee/protect for a one-time, in-memory check of various formats, including npm, Yarn, pnpm, pip, Poetry, Go, Cargo, Composer, Bundler, Dockerfiles, and workflows. The service does not store uploaded files.
For terminal or CI integration, users can utilize a curl command that returns HTTP 422 if an issue is detected and 200 if everything is clean. Additionally, a GitHub Action named pwned-coffee/check-action is available for automation purposes.
For coding agents, pwned.coffee offers a read-only MCP server at pwned.coffee/mcp, featuring six tools: check_repo, check_lockfile, lookup_cve, todays_specials, whats_new, and diff_since. An example command for integration is claude mcp add --transport http pwned-coffee https://pwned.coffee/mcp.
Users can report errors on any ticket, with reports directed to public GitHub issues. Corrections are logged with their sources. The service also provides optional email alerts for new critical incidents filtered by stack.
Launch Details
pwned.coffee is listed as launched in 2026, and the service is free to use. The maintainers emphasize that the vendor advisory linked on each ticket is the authoritative source for security information.
Original source: Product Hunt