Observed arrival · 2026-10-24
Zero Day Canary gives small teams a vulnerability triage desk
It checks whether reviewed software-vulnerability alerts may affect a website or app, and offers a public alert catalog and API.
○Open
⊠Login
$Paid
†Ads
✦Pretty
●Pro
◎Niche
◉Human
⚑Risk
ƒJS
- For
- Small businesses, nonprofits, and software developers
- Worth noticing
- It names supported package ecosystems and explicitly excludes internal packages, authenticated areas, and hidden versions.
Field notes
A business-facing check starts with a system URL; builder reports can test confirmed public package names and exact versions against supported OSV ecosystems. The site distinguishes a possible match from proof that an affected version is deployed, and says it cannot inspect internal packages, authenticated areas, or hidden versions. Its alert coverage currently names GitLab, Next.js, Node.js, Oracle Java/GraalVM, PHP, and Plex.
Observed signals
Read the marks
Editorial observations of this landing page, not a rating.
○OpenPublic substance visible
✦PrettyNotable craft visible
●ProPolished or operationally mature
◎NicheUnusually specific use
ƒJavaScriptBrowser-side code central
One card from the complete issue