Docs

When Grype, Trivy or Dependency-Track turns up something in your product that's actually being exploited, craclock works out whether you have to report it, prepares the report, and keeps the proof of when you knew and what you filed. You submit it yourself: a filing is a legal statement by you, not by a tool, so craclock hands you the finished text instead of sending it for you.

• QuickstartPlanned

  From nothing to a rendered early warning package in about ten minutes.

• Concepts

  What a case is, why the clock runs from awareness, and why rulesets are versioned. No regulatory background required.

• What the package looks likePlanned

  A real early warning package, generated from the ruleset and a golden fixture case.

• InstallPlanned

  Install the craclock CLI, or self-host the full server.

• CLI referencePlanned

  Every craclock CLI subcommand: what it does, its flags, and the output it prints.

• GitHub ActionPlanned

  Run craclock scans and status checks in CI.

• Self-hostPlanned

  Run the full craclock server on your own infrastructure.

• Security

  Encryption, hosting, subprocessors, the audit chain, and how to report a vulnerability.