What has shipped

Advisory pages say how serious the rating is, whether you installed the package or a dependency did, and how to remove a Drupal module that will not be fixed.

Each page now names the command for your case: composer why to see who required the package, composer why-not to see what blocks the fixed release, and the uninstall order for a Drupal project marked unsupported. The security.txt generator gained a reference for every RFC 9116 field and a check to run after you deploy. security.txt generator

A comparison with ConformOps, an about page and a blog.

The comparison puts both tools side by side, with every ConformOps fact taken from its own site and dated. The about page says who runs PatchClock and from where. Compare

The free check now separates what to fix from what is only recommended, says when a result was reused from the last hour, and ends with the one next step to take.

A list of twenty findings is hard to act on; a short list of what to fix, and one thing to do first, is not. Run the check

Refunds: 14 days on regular plans, 30 days for founding members.

The window counts from the first payment, and founding members also get a full refund if access does not open on the launch date. Refund policy

The guides hub starts with where to begin, the two CRA dates and the steps you can take this week.

The two dates are 11 September 2026, when the reporting duties apply, and 11 December 2027, when the rest of the regulation does. Guides

In the app: one button drafts the Annex VII technical documentation from your repository and what PatchClock already knows.

The draft follows the order of Annex VII, filled in with what PatchClock already knows, so you edit a document instead of starting from a blank page.

In the app: a product is read again within a minute of a push, so the SBOM follows each release.

An SBOM that is a release behind lists the wrong dependencies, and the CVE alerts built on it go wrong with it.

A subprocessors page, linked from the privacy notice and the terms.

It lists the companies that process customer data for PatchClock, what each one does and where. Subprocessors

Every PHP advisory in the digest gets its own page, and every affected Composer package a page listing its advisories.

Each page says who is affected, which versions fix it and how to check your project, and follows its advisory after it goes up: a new fixed release or severity shows on the page. All advisories

Search, a severity filter and numbered pages on the lists of advisories and packages.

You can look up a package by name, or show only the advisories of the severity you care about, instead of scrolling the whole list. Packages

The weekly PHP security digest: last week's advisories for Composer packages, with a double opt-in email.

It goes out every Monday, most serious and most installed first, and marks the advisories known to be exploited in the wild. The digest

In the app: upload the signed Declaration of Conformity; digital signatures, including Autenticação.gov, are checked.

The declaration is the document you sign to put a product on the EU market under the CRA, so the app keeps it with the product it covers.

In the app: pages stay current without a refresh.

What changes while you are on a page, such as a new alert or an incident moving on, shows up there without reloading it.

In the app: SBOM and CVE alerts for Composer and npm.

PatchClock reads composer.lock and package-lock.json for every version you support, checks them each day and emails your team when one is affected.

In the app: customer accounts with products, a team and invitations, in more than one language.

Each account holds its own products and people; you invite the colleagues who should get the alerts and work the incidents.

In the app: the incident runbook with the 24h, 72h and 14-day clocks, customer security notices and public security pages.

These are the Article 14 deadlines: an early warning within 24 hours of knowing a vulnerability is exploited, a notification within 72 hours and a final report within 14 days of the fix. Article 14 reporting

The free CRA readiness check, the security.txt generator and the first two CRA guides.

The check reads your public site for what the CRA expects to find there. The generator writes an RFC 9116 security.txt in your browser, without sending anything to us. security.txt generator