A research project, not a product
PatchNotice is an independent vulnerability-notification project. I built and run an automated, passive scanner that reads public websites, matches the software versions it sees against public vulnerability databases, and emails owners whose sites run software with serious, known vulnerabilities.
Why
Most compromised websites are compromised through known vulnerabilities in outdated software, not through anything new. The fix usually exists already, sometimes for years. Owners often simply don't know: an agency built the site and moved on, automatic updates are off, or the server was set up once and never looked at again.
A short, specific note closes that gap: this version, observed here, is affected by these CVEs, and this is the release that fixes them.
Who
I'm Abdelrahman. I designed and built the whole pipeline: discovery, passive fingerprinting, vulnerability matching and the notices themselves. It runs on its own, end to end, including sending. There is no team, no investors and no company behind it. Replies to notice@patchnotice.org are forwarded to me, and a reply saying “stop” opts the domain out automatically.
What it holds to
- Nothing is for sale. The email is the whole interaction.
- The scanner reads what a site publishes to every visitor. It never tests whether a vulnerability works.
- It keeps technical fingerprints and a published contact address. Nothing about people.
- One notice per domain, built from what was observed, and never a follow-up.
- This site sets no cookies and loads no analytics or third-party scripts.
- Opt-outs are honored immediately and permanently, without anyone having to read them.
The scanner
The scanning and matching engine is developed openly at breachdetect.net. PatchNotice is the notification side of that work. The vulnerability data comes from public sources: NVD for CVEs and CVSS scores, CISA's Known Exploited Vulnerabilities catalog, FIRST's EPSS, and endoflife.date for release support windows.