When something in your product turns out to be exploited, craclock works out whether you have to report it, prepares the report, and keeps the proof.
It starts wherever the finding actually shows up: Grype, Trivy, Dependency-Track, a customer report. You submit the filing yourself; that step is a legal statement from you, not from a tool, so it's always yours.
Not sure this applies to you? Take the two-minute scope check.
This is what comes out the other side, filled in and ready to paste:
Early Warning package (excerpt)
- CVE ID
- CVE-2026-41234
- Manufacturer name
- Nimbus Sensors GmbH
- Product name
- Nimbus Edge Gateway 3.4.1
- Title
- Actively exploited path traversal in the Nimbus Edge Gateway TLS termination module
The mechanic underneath: three deadlines, running from the moment you become aware, not from when you open the portal.
- 09:00Awareness
- 23h 42mEarly Warning
- 2d 9h72-hour Notification
- pending fixFinal Report
The CLI isn't released yet. When it is:
brew install craclock/tap/craclock
ENISA's portal has no API. craclock generates the package; you paste it.
Free
€0
- 1 product
- Exploited-vulnerability alerts by email
- Cases
- Clocks
- Audit trail
- Paste-ready package
Team
€69/mo
- 5 products
- Slack, Teams and webhook channels
- Invites
Founding customers: the first 20 get six months for €149, prepaid, refundable. Reserve a spot
Scale
€199/mo
- 25 products
- Write API access
- Webhooks
- Self-host licence keys