Twenty-eight vulnerabilities, one upgrade
Vulnerability monitoring is live on every plan from Pro up. It reads the version your service reports, matches it against published advisories every day, and tells you the one thing to go and do about it.
One row per service, not one per CVE
Each service gets a single row: the version to move to, and how much of the backlog it clears.
| Service | Product | Upgrade | Findings | Clears |
|---|---|---|---|---|
Dashboard Lucy & Jack Clothing | Metabase | v0.56.11→58.28 | crit 4med 3 | 7all of them |
Orders Database Lucy & Jack Clothing | PostgreSQL | 18.4→18.5 | high 18med 7low 3 | 28all of them |
The number that made us rethink the design
The first real database we pointed this at came back with twenty-eight open findings. Eighteen high, seven medium, three low, every one of them a genuine published CVE against the version it was running.
Twenty-eight is the sort of number that makes a security tool useless. It reads as an afternoon of work, and it is the reason people close the tab. Except it was not twenty-eight pieces of work. PostgreSQL ships security fixes in point releases, so all twenty-eight were fixed by moving from 18.4 to 18.5. One upgrade. One maintenance window.
So we built the product around that rather than around the list. A service gets one row, and the row carries the version to move to and how much it clears. The findings are still all there, in full, with their scores and their advisories — but they are the detail behind the decision, not the decision itself.
Upgrade path visualisation
Once you know an upgrade clears everything, the next question is what a smaller upgrade clears. That answer is usually worse than people expect, and it is invisible in any list of findings.
Every finding here is fixed by one upgrade. Stopping short leaves the rest open.
This Metabase is seven findings behind, four of them critical. Upgrading to 0.58.16 — which looks close enough to current — still leaves one open. Only 58.28 clears the set. That is one line of a page and it is the difference between a maintenance window that finishes the job and one you have to book again.
It runs on the monitoring you already have
There is no scan to configure and no new target to point at anything. It is a toggle on a monitor you already set up, and what it does is read what the service already tells the world about itself. No agent, no access to your source, nothing that touches your data.
Databases were the interesting case. For a Postgres monitor we already hold the connection, so we ask it SELECT version() — which needs no permission beyond connecting, and is the most reliable version signal in the product. A web app can have its version stripped from its markup. A database will tell you exactly what it is.
4 critical, 3 medium. All clear at 58.28.
Where you will actually see it
On the monitor page you were already looking at: the three worst findings, the upgrade that clears them, and a link to the rest.
New findings also arrive as one grouped email to whoever owns security. Each finding is reported once. Nothing about any of it ever appears on a public status page.
What it does not do
It matches published advisories against reported versions. It does not scan your network, attempt to exploit anything, or read your code, and it is not a replacement for a penetration test.
Two limits worth knowing before you turn it on. If a component does not report a version — a bundled plugin, a custom theme — we say so by name rather than counting it as clean, because an unchecked component is not a clean one. And a managed database provider may have already patched a finding without changing the version string it reports, so on RDS, Aurora or Cloud SQL some findings may already be handled. We tell you that on the page rather than letting you find out from a support ticket.
Turning it on
Open a monitor, switch on vulnerability detection, and the first check runs immediately. It is included on Pro and Elite at no extra cost.
Find out before someone else does
If you already monitor a Postgres, a WordPress site or a Metabase with NoDisrupt, this is one switch away.