Checks SECURITY.md against the EU Cyber Resilience Act clocks that went live 11 Sep 2026: 24h early warning, 72h notification, 14-day final report, 5-year support period, CVD policy, SBOM. Runs entirely in your browser — nothing is uploaded.
Same engine as the VS Code extension, byte for byte.
Free for the file open in your editor - no key, no limit. The workspace sweep and the report ask for a key.
VS Code Marketplaceext install ReadyStack.cra-reporting-clock-lint
Team? One key for every ReadyStack linter, 5 seats, $149 once
Scans every SECURITY.md across the whole workspace in one pass and writes the corrected, clause-referenced policy text out to a dated audit file you keep.
One payment, one licence key for this tool. The key is shown right after payment.
The human alternative is EU product-compliance counsel reading the same file by the billable hour; Art. 64(2) caps an Article 13 or 14 infringement at EUR 15,000,000 or 2.5% of total worldwide annual turnover, whichever is higher.
Buy the full version — $29It reads the SECURITY.md you have open and checks it against 17 rules drawn from Regulation (EU) 2024/2847. Each finding names the article or annex point and the deadline: 24 hours for the early warning, 72 hours for the notification, 14 days for the final report, five years for the support period. It reports; it does not file anything.
Maintainers and product engineers who place software with digital elements on the EU market and own the repository's SECURITY.md. That includes commercial open-source vendors, SaaS teams shipping installable agents, and firmware teams. It is aimed at the person who has to answer a customer's CRA questionnaire, not at a compliance department.
A Markdown linter checks heading levels and link syntax. It has no article numbers, and it cannot tell that a published support end date of 2025-12-31 has already passed. This extension compares your file against dated obligations and against today's date, offline, with the clause number attached to every finding.
Free covers one file completely: open a SECURITY.md, run the lint, read every missing or contradicted clause with its article number. The full version adds a different axis, not a bigger drip: a workspace-wide pass over every SECURITY.md, and a written, dated audit file containing the corrected clause-referenced text.
The ordinary route is having EU product-compliance counsel read the policy by the billable hour, then repeating that each time the file changes. The statutory ceiling on the other side is Art. 64(2): EUR 15,000,000 or 2.5% of total worldwide annual turnover for an Article 13 or 14 infringement, whichever is higher.
One question, answered by the person who built it. Your email only if you want the answer sent.
Paste this code into your page. It runs in your visitor’s browser and stays up to date. Nothing your visitors type is stored.
For businesses: your name and logo instead of ours, and each visitor’s result + e-mail in your inbox (only when they tick consent) — Pro from $19/month. See Pro →