Frequently asked questions

StackFlag monitors public vulnerability databases (NVD, the MITRE CVE List, GHSA, OSV, CISA KEV, EPSS, and Vulnrichment) every hour. When a new vulnerability matches software in your stack, we flag it with a plain-English summary explaining what the problem is, how serious it is, and what you should do about it. Think of it as a security news feed filtered down to only the things that affect you.

No. StackFlag is designed for developers, IT managers, and business owners who are not security specialists. Vulnerability descriptions are rewritten in plain English with clear remediation steps. You describe your software in everyday terms ("we run WordPress on nginx with a PostgreSQL database") and StackFlag handles the technical matching.

After signing up, use the Stack Wizard to describe your software in plain English. StackFlag analyses your description and creates stacks automatically. You can also add stacks manually by searching for specific software names or CVE identifiers. The whole setup takes about two minutes.

We pull from seven sources, updated hourly: the National Vulnerability Database (NVD), the MITRE CVE List (all CNAs), GitHub Security Advisories (GHSA), Open Source Vulnerabilities (OSV), CISA Known Exploited Vulnerabilities (KEV), Exploit Prediction Scoring System (EPSS), and CISA Vulnrichment. This covers the vast majority of publicly disclosed vulnerabilities across all ecosystems.

We follow the risk model CISA introduced for US federal agencies in June 2026 (Binding Operational Directive 26-04). Instead of a severity score, the deadline comes from four questions: can the software be reached from the internet, is the vulnerability known to be exploited, can an attack be automated, and does it give an attacker full control. The answers set a deadline between 3 days and your next planned upgrade. Every vulnerability page shows the deadline for internet-facing and internal systems, and if you tell us where each stack runs, your flags show the one that applies. Email alerts can also be ordered by deadline, or limited to flags due within 3, 14 or 60 days. It is guidance to help you prioritise, not a compliance service. How deadlines are set

Yes. StackFlag watches for new vulnerabilities continuously and alerts you when one matches your stacks, and you can turn on a triage audit trail (unread, read, acknowledged, dismissed) with timestamped notes for the stacks that need one. This maps directly to controls in ISO 27001, SOC 2, Cyber Essentials, NIS2, PCI DSS, and NIST 800-53. Your flag history serves as evidence that vulnerabilities were identified, assessed, and actioned.

StackFlag is free during the beta period. All features are available to all users at no cost. We will introduce paid plans in the future, but beta users will be given generous notice and migration terms. Contributors who submit significant bug reports or improvement feedback may receive a free account when paid plans launch. Use the feedback button to share your thoughts.

There is no separate team login, and you do not need one. An alert can send to several email addresses at once, so everyone who should see a flag does. You can also create a feed alert, which gives you a private URL for a feed reader - share that with a colleague, or add it to a channel that supports feeds.

If you look after several clients or environments, tag your stacks by client, site or department, then point a separate alert at each tag. Each one can have its own recipients or its own feed URL, so a client only ever sees their own flags.

Absolutely. Use the feedback button (bottom right of any page) to send bug reports, feature requests, or general suggestions. If you tick the credit checkbox, your name or handle can be acknowledged when the feature ships. Contributors who submit significant, actionable feedback may receive a free account when paid plans launch. See product updates for what we've been working on.

Recent updates

All updates
Busy alert emails now lead with what matters most 16 Oct 2026

When an alert has more new flags than fit in one email, it now shows the most severe ones first instead of the oldest. The rest are summarised with a link to your dashboard, rather than carried over into the next email.

Fewer old vulnerabilities presented as new 30 Sep 2026

When the advisory for an older vulnerability was republished or updated, it could be flagged to you as if it were new, sometimes many at once. An older vulnerability now only reaches you as new if it has just been added to StackFlag, in which case the alert says so, or if it has just been found to be exploited. The old flags this produced over the past two days have been removed.

If more than one of your alerts covers the same stack, each one now reliably receives every flag. Previously an alert could miss flags another alert had already sent.

Faster, clearer vulnerability pages 30 Sep 2026

Vulnerability pages now load in a fraction of a second, where some took several seconds.

The facts panel is simpler to read. Each section leads with one figure, and the detail - which scores make up the severity, and what the chance-of-attack figure means - sits behind an information icon. Each part of the fix-by deadline is marked, so you can see at a glance what is driving it.

How quickly to fix it, not just how bad it is 30 Sep 2026

Every vulnerability page now gives a fix-by deadline: one for software reachable from the internet and one for internal systems. Deadlines follow the risk model CISA introduced for US federal agencies in 2026, which weighs whether a flaw is known to be exploited, whether attacks on it can be automated, and how much control an attacker gains, instead of relying on a severity score alone. We also now carry CISA's assessments for far more vulnerabilities, including older ones known to be exploited.

Tell us whether each stack is internet-facing or internal - one at a time, or several at once from your stack list - and your flags show the one deadline that applies.

Alerts can now list the most urgent flags first across all your stacks, or send only flags due within 3, 14 or 60 days. Stacks set to alert you on updates also tell you when a deadline gets shorter. Our new fix-by deadlines page explains how it all works.

Much deeper vulnerability history 29 Sep 2026

Many older vulnerabilities were missing from StackFlag because of a problem storing some records from one of our sources. They have now been added, so searching for an older CVE, or checking what has affected your software over the years, is far more complete - going back to 1999.

If an older vulnerability reaches StackFlag for the first time and matches one of your stacks, the alert now says it is not a new disclosure and shows when it was first published, rather than presenting it as news. Filling in the missing history did not send you any alerts.

See all product updates