Revere

Hear it first.

Threat intelligence for software teams. Revere watches where attacks start, matches what it finds to your stack, and tells you what to do.

Get early access See what an alert looks like

Small teams have no one watching.

Many small companies have no security staff. The engineers who ship the product also look after the servers, the dependencies and the cloud accounts.

Advisories often arrive days or weeks after the fix is already public, which gives attackers time to read it first. Scanners add hundreds of alerts on top, and the few that matter get lost among them.

  1. The fix landsQuietly, in public code.
  2. Attackers can read itThe change is visible to anyone, from day one.
  3. The advisory is publishedDays to weeks later. Most alerts start here.

From a quiet commit to a level from 5 to 1.

Five steps, in this order. Code makes the decisions. AI only reads and explains.

  1. Readers collect

    Hardened Readers watch code commits, security advisories, public exploit repos, researcher posts and forums, and sources in other languages and regions. They report what was said, never what to believe.

    Passes onTyped facts from a closed set. No free text from attackers.

  2. Claims are corroborated

    When a claim keeps coming up, Revere checks it across independent sources. Ten posts on one forum count as one source.

    Passes onHow many independent kinds of source agree.

  3. The proof lab tries it

    Unproven exploits go to an isolated sandbox. The lab records whether the bug ran, and which version fixes it.

    Passes onReproduced or not, and the first fixed version.

  4. It is matched to your stack

    Revere compares the threat with the packages, images and services you actually run. Anything that does not touch your stack stays out of your way.

    Passes onWhich repo, which version, and whether it is exposed.

  5. You get a level and one action

    A DEFCON level from 5 to 1, with plain advice such as “upgrade this package to that version”.

    You receiveA level, the reason, and the exact thing to do.

Your level, at a glance.

  1. 5QuietNothing needs you.
  2. 4WatchingEarly signals on your dashboard. No alert.
  3. 3ElevatedFix this week. Weekly digest.
  4. 2Act todayAn alert is sent at once.
  5. 1Act nowAn alert is sent at once, and the page leads with it.

The level is the most severe one across your open alerts. Rules, not mood, set it, and every alert records which rule fired.

An alert you can act on in a minute.

  • Why it applies to you.Which repo, and which version you run.
  • The one thing to do.An exact command or target version.
  • How sure Revere is.The status, and the sources behind it.
Open the interactive alert view
2Act todayEXAMPLE-0001

Upgrade acme-parser to 4.2.1

Why you
web/package-lock.json has acme-parser 4.2.0. Your public upload endpoint passes files to it. Fixed in 4.2.1.
What to do
Run this in the repo.cd web && npm install acme-parser@4.2.1
How sure
Reproduced in the proof lab. Three independent kinds of source report it. Not yet reported as exploited.

Fictional package and id, shown for illustration.

What we have measured so far.

88%
In a benchmark of 120 commits with security labels removed, a two-model pipeline running on one consumer GPU caught 88% of the security fixes at 91% precision.
18 days
In the npm advisories we studied, the fix landed a median of about 18 days before the public advisory.
42%
Public chatter came before CISA’s exploitation notice for 42% of 323 recent exploited vulnerabilities, by a median of 11 days.

Early prototype results on small samples. A later test on 1,522 commits found about 82% of 300 advisory-linked fixes, and flagged roughly 1 to 3% of ordinary commits, judged by one reviewer’s hand labels. These numbers show the idea is worth building. They are not a promise of what customers will see.

Built on the assumption it will be attacked.

Revere will hold many companies’ stacks and an early view of real bugs, which makes it a target. Our stance is that every part is compromised until proven safe, so the design limits what a compromised part can reach.

Most of this is a design, not a shipped product. We say so here so you do not have to wonder.

Readers

Touch hostile content on the open internet. Hold no customer data and no keys to anything else.

Proof lab

Runs risky code in a sealed sandbox and reports a result. Nothing else leaves.

Your stack

Matching and delivery. The only place your packages and services are known.

Compartments, like a ship’s hull.

Each compartment has its own accounts, keys and admin access. A breach is meant to flood one compartment while the rest stay afloat.

Hostile content gets typed answers only.

The AI that reads attacker-controlled posts and code returns only values from a closed set. It cannot hand free text to the parts that make decisions.

Data flows one way.

Threat data moves toward you. Your data is never routed back toward anything that reads the open internet.

Be among the first to hear it.

Revere is in early development and not yet open to customers. Join the early-access list and we will write when there is something real for you to try.

Request early access See an example alert first

This opens an email to us. We do not run any analytics or trackers on this page.