appCanary monitors the software on your servers and notifies you when you have to take action. In a previous life, we spent a lot of time worrying about what needs to be updated where and so we built this.
We currently let you know about Ruby vulns deployed on any linux, and vulnerable packages if you run Ubuntu. Support for Docker and other vuln sources is just around the corner.
We'd love to hear your feedback!
It sounds like for most software you are using the Ubuntu package management system to check for vulnerable versions. Is that correct? And are you planning to add detection for binaries that live outside of the distro package manager? I am thinking of stuff like custom-compiled Nginx binaries for example. I realize it would be non-trivial to implement this but would consider it highly useful at least for a certain set of common software components.
It's on the roadmap! Others have mentioned that before. First we need to get really good at knowing about CVEs :).
Unfortunately it's not easy -- even writing scripts to detect running processes across all our servers to identify Java, Apache, Tomcat, etc etc has proven difficult to get right. Sometimes you can get enough info from extended process list info, sometimes not.
Sucks.
It's definitely a leg up over just being spammed by pkg audit.
Further, we also cover your app dependencies :).