pwned.coffeeUpdated 3 min ago

How not to get pwned

The board tells you what's on fire. This page tells you whether it's your fire, and what to do about it. Five steps, most of them under a minute.

  1. Tell us your usual

    Pick what you run. The board, the fire, the feeds and the badge shrink to just that. It lives in a cookie on this device. No account, no email.

    Choose your usual

  2. Check your lockfiles right now

    Drop or paste a lockfile. You get a receipt with the exact upgrade command for anything affected. Nothing is stored. We read it, we check it, we forget it.

    Or paste one

  3. Put it in CI

    The same check from a terminal. Send any number of files with -F.

    curl -sS -F f=@package-lock.json https://pwned.coffee/api/check

    Or let GitHub Actions run it on every pull request and every morning. It fails the build when something you ship is affected and prints the receipt in the log.

    name: pwned.coffee
on:
  pull_request:
  schedule:
    - cron: "17 7 * * *"   # every morning, with your coffee
jobs:
  check:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4   # pin this to a full commit SHA. We would.
      - name: Check lockfiles against today's specials
        run: |
          args=()
          while IFS= read -r f; do args+=(-F "f=@$f;filename=$f"); done < <(git ls-files | grep -E '(package-lock\.json|yarn\.lock|pnpm-lock\.yaml|bun\.lock|requirements.*\.txt|poetry\.lock|uv\.lock|Pipfile\.lock|go\.sum|Cargo\.lock|composer\.lock|Gemfile\.lock|Dockerfile|\.github/workflows/.*\.ya?ml)$')
          curl -sS --fail-with-body "${args[@]}" "https://pwned.coffee/api/check?fail=1"

    Save it as .github/workflows/pwned-coffee.yml.

  4. Let your agent do it

    Cursor, Codex, Claude Code, Gemini CLI, Windsurf and Zed can read your whole repo, send it to our MCP server in one call and propose the upgrades as a diff.

    https://pwned.coffee/mcp
    claude mcp add --transport http pwned-coffee https://pwned.coffee/mcp

    Every tool, and prompts to paste. Want a full audit, not just dependencies?

    npx skills add https://github.com/cloudflare/security-audit-skill --skill security-audit

  5. Keep an eye on it

    Feeds for your usual, for a reader, a Slack bot or a cron job.

    And a badge for your README that goes red when your stack does.

    Next.js status on pwned.coffee

    [![Next.js on pwned.coffee](https://pwned.coffee/badge/nextjs.svg)](https://pwned.coffee/menu/nextjs)

The barista's house rules

  1. Patch what is exploited first.A critical nobody is using can wait until after lunch. An exploited high cannot.
  2. Pin GitHub Actions by commit SHA.Tags can be moved. Ask anyone who used tj-actions.
  3. Keep admin panels off the internet.If it has a login page and a version number in the footer, someone is scanning it right now.
  4. Rotate after a supply-chain scare.If a package you run went bad, the tokens it could read went bad with it.
  5. Turn on MFA everywhere it exists.Especially the boring places: registry, DNS, cloud console.
  6. Do not deploy on Fridays.Patching on a Friday is allowed. Encouraged, even.