Your dependencies, kept current every month
Every application depends on hundreds of open-source packages. Security fixes for them come out every week, and the major upgrades pile up until one of them becomes a project. We take that work off your team: tested pull requests, a monthly report, and a plan for the big upgrades, for a fixed monthly fee instead of a hire.
The problem we take over
- Bot pull requests nobody merges. Dependabot and Renovate open the updates, but each one needs someone to read the changelog, run the app and merge. They sit for months, and the security fixes sit with them.
- Major versions that get skipped. A framework major cannot be bumped by a bot. When an advisory is fixed only in the next major, the fix becomes a migration, and that migration has no owner.
- Questions you cannot answer quickly. "Are we affected by this new advisory? In which product, which version?" Answering takes an up-to-date inventory of what you ship.
How it works
1. Initial review
Fixed price, agreed up front. We go through your repositories: known vulnerabilities in what you deploy, how far behind each dependency is, abandoned or deprecated packages, open bot pull requests. You get a written report with a prioritised plan, yours to keep whether or not you continue.
2. Monthly maintenance
Each month: security fixes and upgrades as small, tested pull requests your team only has to review; the open bot pull requests reviewed, tested and either merged or explained; one planned migration step at a time for the major versions; a short report of what changed and what is next.
3. When an advisory lands
When a critical advisory affects something you ship, you hear from us with the affected repositories and versions, and a fix as a pull request, rather than finding out from a scanner or a customer.
The EU Cyber Resilience Act
Since 11 September 2026, manufacturers of software with digital elements sold in the EU must report actively exploited vulnerabilities to ENISA within 24 hours, and the full set of obligations applies from December 2027, including a software bill of materials (SBOM) for each product and a documented vulnerability handling process. As an option, we produce and keep the SBOM of each release current, and run the vulnerability handling for your dependencies: monitoring, assessment, fixes and the record of what was done. This is technical support for your process, not legal advice.
How we work
- Everything comes as pull requests in your repositories, through your normal review. We do not need production access.
- Each pull request says what was checked: build, type check, tests, and what could not be tested and why.
- We say when an upgrade is not worth it, or when a dependency should be replaced rather than patched.
- JavaScript and TypeScript (Node.js, Next.js, React) and Python. Ask for other stacks.
Our work in public
We measure and publish what we find in other people's code: example apps that ship vulnerable dependencies, install commands that point to unclaimed package names, and the false-positive rate of our own checks. Fixes we contributed have been merged by projects such as NVIDIA SkillSpector, OpenHands and Countly.
Start with a review
Write to presendapp@gmail.com with a link to the repositories (or a short description if they are private). We reply with what the initial review would cover and its fixed price.