Weekly on Monday · security the same day · email only
Briff reads lockfiles, version files and Dockerfiles, never your code. It follows the release notes and advisories of what they name and tells you which repo needs which command.
Sign-ups are closed for now. Ask for an account, or run your own: one Docker image and Postgres, configured with environment variables.
Two real incidents from October 2026, replayed through Briff's own pipeline: the items the vendors published, with their timestamps, sample repos, and the production email templates. No model is involved in a security email.
Two critical PHP remote code execution flaws leaked before their coordinated release.
Node.js pre-announced security releases for the 26.x, 24.x and 22.x lines a week ahead, then rewrote the same post on release day with 22.23.4, 24.22.1 and 26.12.1.
Three ways in, one list of files. Each path parses the same files into package, version and runtime rows with the same code, and never reads source code.
Install it on the repos you pick, from Settings after you sign in. Permissions: contents and metadata, read-only. Briff reads the default branch's list of paths, fetches only the files below, and rescans when a push changes one of them.
One workflow per repo. The scanner runs in your CI and uploads the rows with a scan token from Settings; nothing else leaves the runner.
# Briff scan (briff-scan 0.1.1, pinned to @0)
name: briff
on:
push: { branches: [main] }
schedule:
- cron: "0 3 * * 1" # Mondays 03:00 UTC, before the bulletin
jobs:
scan:
runs-on: ubuntu-latest
steps:
- uses: actions/checkout@v5
- uses: actions/setup-node@v5
with:
node-version: 22
check-latest: true # newest 22.x, not the runner's cached one
package-manager-cache: false
- run: npx briff-scan@0
env:
BRIFF_API_URL: https://app.briff.dev
BRIFF_TOKEN: ${{ secrets.BRIFF_TOKEN }}
On a laptop or a build box, in one repo or every repo under a folder. --dry-run prints what would be sent and sends nothing.
npx briff-scan@0 --dry-runOnly these names, at most 6 directories deep, never inside node_modules, dist, build, out, coverage, vendor, target, Pods, DerivedData, venv, site-packages, __pypackages__, __fixtures__, fixtures, testdata, __mocks__ or a directory whose name starts with a dot.
Never read: source code, READMEs, workflows, environment files, issues, pull requests or git history. File contents become rows and are not stored.
The Monday bulletin and the security email from the PHP2Shell replay, for three sample repos, rendered by the same components and templates as the app. In production a model writes the headline, one line per item and the good-to-know list; here the item title stands in.
api: set php 8.4.27 in .tool-versions · garden.example: rebuild to pick up PHP 8.3.36; the php:8.3-fpm tag already points to it · legacy-shop: php 8.1 is end-of-life and will not get this fix; move to 8.2.35 or later
No new advisories for this stream's repos this week.
Sent on the first hourly run after the fix is public: what each repo runs, the fixed versions, one step per repo and every source folded into one block. A repo on an end-of-life line is told to migrate, never handed a command for a major it is not on.
Wed 21 Oct · 14:00 UTC · +26 min
Briff keeps repo names and the package, version and runtime rows from your files. These are its only outbound connections; self-hosted, leave the Anthropic key empty and nothing goes there, leave SMTP empty and no email leaves.