Changelog
What changed in Provetry
Every change you can see, month by month, newest first.
November 2026
The terms of service, privacy policy and legal notice are final, in English, French and German (the English text prevails). The changelog now groups changes by month.
The activity log of the workspace and the components whose support ends before your support period are now on the Pro and Consultant plans only, as the pricing page said. Every action is still recorded on every plan, and shows when you move to Pro or Consultant; components are looked up as soon as you do.
Each plan now states how much room your releases may take: 100 MB on Free, 1 GB on Starter, 5 GB on Pro, 20 GB on Consultant. The plan and billing page shows what you use; when a plan is full, delete old releases or choose a larger plan.
A new look for this site: the home page shows the screens of the product, the pricing page compares every plan line by line with monthly or yearly prices, the guides can be filtered by topic and each guide has its contents on the side.
A free SBOM generator: pick your project folder or its lock files and get a CycloneDX 1.6, SPDX 2.3 or SPDX 3.0.1 SBOM, with the direct dependencies marked. It runs in your browser, with provetry-core, the open-source engine behind Provetry.
A clearer customer area. Each product now opens on an overview with what to do next, then tabs for its vulnerabilities, releases, compliance dossier, advisories, buyer pack and settings. Vulnerabilities show as a list with the details beside it, filters, keyboard keys (J, K, X) and the same decision for several at once; a decision just saved can be undone. Search everything with Ctrl K or ⌘ K, open the help for the page you are on from the ? button, and compare two releases of a product.
The overview of your workspace: a getting-started checklist, what to do now (reporting deadlines, exploited vulnerabilities, decisions to make), and the weekly trend of open and exploited vulnerabilities over twelve weeks. A bell lists what happened since your last visit, and a compact display fits more on the screen.
Sign in with a passkey: your fingerprint, face or device PIN instead of a password and a code. Add one or more under Settings.
SBOM of a container image or a device firmware, generated by Provetry itself: the CI step reads an image name, a docker save archive or a root filesystem archive (Yocto, Buildroot), with its dpkg, apk and opkg packages and the Python and Node.js packages installed. Debian, Ubuntu and Alpine packages are watched by distribution release, Wolfi and Chainguard packages as such; RPM, opkg and releases no public advisory database covers are not looked up yet, and the release says which components are not watched.
More ways to pay: SEPA direct debit next to the card, for every plan and the Reviewed reports add-on. Businesses on a yearly plan can also pay by bank transfer on invoice, within 30 days, with their purchase order number printed on the invoices.
In German, the app, the website, the help, the guides and the disclosure policy Provetry writes now follow the wording of the German text of the CRA: “Strategie für die koordinierte Offenlegung von Schwachstellen”, or “Offenlegungsstrategie” for short.
A 14-day trial of the Pro plan, with no card: start it from Plan and billing. At the end, the workspace goes back to Free by itself unless you chose a plan.
Alerts in Slack and Microsoft Teams, on paid plans: connect a channel by its incoming webhook (a workflow in Teams), with the same settings as an e-mail address: everything or exploited vulnerabilities only, products, severity threshold.
Buyer security pack, on paid plans: one page per product to send to a buyer, behind a secret link that can expire, with the support period, the supported releases and their SBOM if you wish, the VEX feed, your disclosure policy, the advisories and your correction times. Never your open vulnerabilities. You see how many times it was opened.
The first ten minutes: try Provetry with an example product, already filled in, that does not count in your plan; import a release straight from a GitHub repository, public or private, without changing your CI; and see each product’s CRA readiness, item by item, with the days left before 11 December 2027.
The disclosure policy can now be written in German, as well as English and French.
The application is now in German too: every page, the messages, the account e-mails and the alerts. Choose the language in Settings, for yourself and for the alerts of the workspace. Drafts for ENISA stay in English, the working language of its platform.
Security questionnaires received, on paid plans: paste a customer’s questions about one of your products, and each gets a proposed answer, from your library of past answers or from what Provetry records about the product (SBOM, vulnerability watch, correction times, disclosure policy, support period, advisories, technical documentation), dated. Correct them, keep them for next time, copy the answers column or download a CSV.
Correction times, on paid plans: for each severity, how long your vulnerabilities took to handle against the target you set (7 days for an actively exploited one by default), the ones past their target, and a dated evidence log to download, its fingerprint recorded in the evidence journal.
The whole site is now in German too, at provetry.com/de/: the pages, the free tools, the help centre and the guides.
SBOMs in SPDX 3.0.1 (JSON-LD), the version Germany’s BSI asks for, next to SPDX 2.3, on paid plans. SPDX 3 files can be uploaded, and the free SBOM viewer reads them.
Eight more guides: security.txt, CVSS, EPSS and KEV, disclosure policies, open source, SaaS, important and critical products, CE marking, and the CRA and NIS2.
Two more guides: CycloneDX or SPDX, and what VEX is and how to say a vulnerability does not affect you.
Two more guides: a plain-language summary of the Cyber Resilience Act, and every essential requirement of its Annex I, one by one.
In French, reporting to ENISA is now called « signalement », the word of the official text of the regulation.
Two new guides, in English and French: what an SBOM is, and every date of the Cyber Resilience Act from 2022 to 2028.
A help centre: 21 articles on every part of Provetry, from your first release to reporting to ENISA, in English and French.
An EPSS lookup: today’s exploitation probability of up to 30 vulnerabilities at once, from FIRST.
A CVSS 4.0 calculator, scored with the reference calculation of FIRST, next to the CVSS 3.1 one.
Four free tools, in English and French: a security.txt generator and checker, a CVSS 3.1 calculator, a vulnerability disclosure policy generator and an SBOM viewer. They run in your browser.
The whole site is now in French too, at provetry.com/fr/, with its guides.
Our coordinated vulnerability disclosure policy is published in full on the Security page, with our commitments and a security.txt file that renews itself.
The Provetry website is live, with a free check that tells you whether the EU Cyber Resilience Act applies to your product, and our first guides.