Security updates and notices

Zefily checks what your sites and servers run against the advisories and releases their makers publish. Every update or security fix it finds is listed on the Updates page, with the site or server, what it is about, the version you have, the version that fixes it, the severity and the advisory. Security fixes come first. A finding stays on the page until its cause is gone: an update applied, a package removed, or the advisory closed by Zefily once the fix is out.

What is checked#

• WordPress sites: the core version against the newest WordPress security release, and each plugin and theme against the known vulnerabilities of its installed version. Updates waiting for core, plugins and themes are listed too. The check reads the site's last WordPress check (WordPress page); run a check there to refresh it.
• One-click apps and app stacks: when Zefily announces a security fix for an app it installs (for example Supabase or Uptime Kuma), every site installed from that app is listed until you update it. A newer major version of an app (for example Nextcloud 36) is an update, not a security notice.
• Lockfiles and container images: the packages in a site's lockfile (Composer, npm, pip, Bundler, Go) and in its container image, with the vulnerabilities reported against them. Findings at a CVSS score of 7.0 and up are announced; lower ones stay on the page.
• Servers: security updates waiting for the operating system, other package updates, and the operating system packages with known vulnerabilities. Server findings are announced by the daily server check and the CVE scan (Security tab); the Updates page lists them too.

Where the information comes from#

Each source is one of these types. The panel and the agent read only documented feeds and databases:

Zefily matches a finding to its source by the version you have, so an advisory that does not affect your version is not listed. An advisory that Zefily cannot read is reported to its team rather than silently skipped.

Installed versions of one-click apps and stacks#

A security fix for an app is listed on a site only while the site runs a version below the fixed one. The site's installed version is read the way the app documents it. Where the app documents no way to read it, the Updates page says version not readable and the finding stays until the site is updated and Zefily closes the advisory. Zefily never guesses a version.

For lockfile packages and container images, the fixed version comes from OSV's own record of the vulnerability (the fixed event of the affected range that contains the installed version, https://github.com/ossf/osv-schema/blob/main/docs/schema.md, read from https://google.github.io/osv.dev/api/). It is shown only from SEMVER ranges, for npm, Composer (Packagist) and Go packages; for other ranges and ecosystems it stays unknown.

Who is told, and how#

Owners and admins of the organization are told about each new finding once:

• In the panel (the bell and the Updates page): always. This cannot be switched off while the site or server exists.
• By e-mail: for security fixes, on by default.
• To your external channels (webhooks, Slack, Discord, Telegram, PagerDuty, Opsgenie): the event update.security, on by default. A webhook endpoint that you create gets it as well.

Other updates (a newer WordPress plugin, a package update) are told in the panel, once. They do not send e-mail or external events.

Security fixes are not forgotten: while a security finding stays open, it is repeated once a week, as one reminder that lists what is still open. A finding that is applied, or that Zefily no longer reports, is closed and not repeated.

Switching off e-mail and external notices#

You can switch off security notices by e-mail and to external channels, but only after you accept the responsibility yourself. Go to Settings → Webhooks, choose Switch off for e-mail and external channels, read the statement, tick that you accept it and confirm your password. Zefily records your name and the time, and the change is in the activity log. From then on:

• the in-panel notices and the Updates page still show every finding;
• no security e-mail is sent, and no update.security event goes to your channels. An endpoint can no longer drop the event until the switch-off is accepted;
• you are still responsible for applying the fixes.

Switch security notices back on undoes it at any time, without anything to accept. Another owner or admin sees the same state on the same page.

Good to know#

• WordPress updates are applied from the WordPress page. Each update takes a snapshot first and restores the site when it breaks. An app is updated from the site (Deploy now, or Update for an app stack).
• The check runs twice a day, after the security watch. Run a check on the WordPress page for an answer now.
• A finding for an app stays until the fix is out and Zefily closes its advisory, because the app's version on your site is not always known to Zefily.