Monitor

New security problems are found in popular software every day. Monitor watches for the ones that affect what your sites are built with and tells you what to do, in plain words.

Where the problems come from

Lockpick reads these public sources all day.

• OSV.dev, an open database of security problems in open source packages. It includes every problem reviewed by the GitHub Advisory Database, and Lockpick keeps a full copy for JavaScript (npm) and Python (PyPI) packages, malicious package reports included, that it refreshes every hour.
• The GitHub Advisory Database directly, a quick check every hour for the software Monitor follows, so a new problem shows up even before OSV.dev copies it.
• The Known Exploited Vulnerabilities list from CISA, the United States cybersecurity agency. A problem on this list is marked Actively exploited, because attackers are already using it.
• EPSS from FIRST, a daily prediction of how likely each problem is to be exploited in the next 30 days. A problem in the top 5% is marked Likely to be exploited soon.
• Wordfence Intelligence for WordPress core, when it is switched on for your Lockpick. Its problems carry Wordfence's copyright notice and a link to its terms.
• Zero Day Initiative published advisories, for their ids, titles and severity scores.
• The National Vulnerability Database, only for a severity score when the other sources don't give one.

From a scan alone, Monitor follows Next.js, React, WordPress, Supabase, Clerk, Stripe, Firebase, Auth0, Sentry, Vue, Shopify, Wix, Squarespace, Webflow, Framer. When you send your package versions, it checks every JavaScript and Python package in them.

How a problem is matched to your site

Your latest scan of each site shows what it is built with, for example Next.js or WordPress. Monitor lists a problem for every site built with the affected software.

A scan can see the technology, but usually not which version your site runs. That's why Monitor says a problem may affect you, never that your site is vulnerable. If your site already runs a fixed release, nothing needs to change.

Affects you: send your package versions

For an exact answer, send the package names and versions your site's code uses. Lockpick then checks each problem against the versions you actually run, and a match says Affects you, with the release that fixes it, above everything that only may affect you. A problem your versions are already safe from leaves your list, even though the scan still sees the technology.

Only package names and exact versions are sent, never your code, file paths, hashes or private registry addresses. Lockpick reads package-lock.json, npm-shrinkwrap.json, pnpm-lock.yaml, yarn.lock, requirements.txt (pinned lines) and poetry.lock.

• From the terminal, run npx lockpicks deps <site> in the project folder. Add --dry-run to see exactly what would be sent, and --forget to remove the list from Lockpick.
• When you start a Pulse or check again from a project folder, the CLI asks once whether to send its versions and remembers your answer for that folder. --lockfile sends them for that scan only and --no-lockfile skips them.
• A coding agent sends them only when it calls lockpick_send_dependencies, after you asked for it or agreed to it.

Each send replaces the last one, so after an upgrade send again and the fixed problems clear. A problem Pulse or Deep also saw on the live site is marked Seen on the live site. Sending needs a key allowed to manage sites (lockpick login --sites) and the manage right on that site.

Read the Monitor page

Open Monitor in the app's sidebar. The top of the page shows how many technologies Monitor is watching across your sites, how many problems were published this week, how many may affect you and, once you have sent package versions, how many affect you.

Five views choose what the list shows. Once you have a site, Monitor opens on For your sites.

• For your sites lists the problems in software your sites use. Problems that affect a version you sent come first, then the most urgent: actively exploited, then likely to be exploited soon, then by severity. A problem is tagged May affect you when it was published in the last 90 days or is actively exploited, on a site you haven't marked handled.
• Latest lists every problem Monitor has read, newest first, whether or not your sites use that software.
• Exploitation lists only the problems attackers are already using.
• Following lists problems in technologies you choose to follow for a site. Following only adds them to this list. It doesn't send urgent emails.
• Security updates lists recent security news, each headline linking to the full story.

Search by advisory id, title or package name. Filters narrow the list by language or platform, by type (vulnerabilities or malicious package reports), by severity and by how far back to look. Source coverage, at the bottom of the page, shows when Monitor last heard from each source.

On your dashboard

The top of your dashboard shows the same problems in short.

• For your sites lists up to five problems, those that affect a version you sent first, then those that may affect you, the most urgent first. Each one opens in Monitor.
• What's happening shows recent security news about the software your sites use, from the Node.js and React security posts, Vercel, Cloudflare and Netlify, BleepingComputer and The Hacker News, plus problems CISA has just listed as actively exploited. Each headline shows its source, its title and a short teaser, and links to the full story on the source's site. Lockpick never copies the article.

Both appear on every plan.

Relevant now on each site

Each site's Overview starts with Relevant now: the problems that matter for that site, each with a tag and what it rests on.

• Affects you: a package version you sent is affected. It shows the version and the release that fixes it.
• May affect you: the scan saw the software, but not its version.
• Seen live: a Pulse or Deep scan found the affected component on your live site.
• Actively exploited: attackers are already using it.
• Fixed: a new scan no longer found it, or you sent a list with the fixed version.

Tags clear themselves when a new scan no longer finds the problem or you send an upgraded list, and the strip keeps a short history of when each tag appeared and cleared. The Sites list shows how many problems are relevant for each site, a finding linked to a known problem names it on its card, Things to fix can show only those findings, and For your sites on the dashboard can show only what affects you or what is actively exploited. Coding assistants read the same tags in lockpick_site_status.

What each problem tells you

Open a problem to see:

• What happened, in two plain sentences;
• What to do, naming the fixed release when the source gives one;
• Your sites that use the affected software;
• how likely it is to be exploited soon (EPSS) and its severity score (CVSS), when they are known;
• the original sources, with their ids, if you or your developer want the details.

The plain words are written by an AI model from the public advisory text only, never from anything about your sites. Each answer is checked against the source, including every version number it names. When a check fails, Monitor uses a fixed wording instead.

Get it fixed

• Copy guidance for your AI copies instructions for your coding assistant: check which version your code uses, update it if it's affected, run the tests and report back.
• Send to my developer opens an email with the same details.
• Mark as handled records, per site, that the problem is dealt with there, so it leaves May affect you. Undo puts it back. Anyone who can review a site's findings can mark it.

Alerts

When a new problem may affect one of your sites, everyone in the workspace who can see that site's results gets it in the bell at the top of the app. Opening it takes you straight to the problem. Only problems published in the last 14 days, or newly added to the actively exploited list, send an alert, so turning Monitor on never floods you with old news.

Monitor also emails you a weekly digest of new problems, grouped by site, about 7 days after the first one arrives. A new problem that affects a version you sent, and is actively exploited or likely to be exploited soon, is emailed at once instead, on every plan. Every email says what to do and links to the problem in Monitor. To stop these emails, open Settings, then Notifications, and turn off New vulnerabilities, or use the Unsubscribe link in any Monitor email.