# Security updates and notices

> Which updates and security fixes Zefily checks for on your sites and servers, where each comes from, who is told and how, and how to switch the external notices off.

Zefily checks what your sites and servers run against the advisories and releases their makers publish. Every update
or security fix it finds is listed on the **Updates** page, with the site or server, what it is about, the version
you have, the version that fixes it, the severity and the advisory. Security fixes come first. A finding stays on the
page until its cause is gone: an update applied, a package removed, or the advisory closed by Zefily once the fix is
out.

## What is checked

- **WordPress sites**: the core version against the newest WordPress security release, and each plugin and theme
  against the known vulnerabilities of its installed version. Updates waiting for core, plugins and themes are listed
  too. The check reads the site's last WordPress check (WordPress page); run a check there to refresh it.
- **One-click apps and app stacks**: when Zefily announces a security fix for an app it installs (for example
  Supabase or Uptime Kuma), every site installed from that app is listed until you update it. A newer major version
  of an app (for example Nextcloud 36) is an update, not a security notice.
- **Lockfiles and container images**: the packages in a site's lockfile (Composer, npm, pip, Bundler, Go) and in its
  container image, with the vulnerabilities reported against them. Findings at a CVSS score of 7.0 and up are announced;
  lower ones stay on the page.
- **Servers**: security updates waiting for the operating system, other package updates, and the operating system
  packages with known vulnerabilities. Server findings are announced by the daily server check and the CVE scan
  (Security tab); the Updates page lists them too.

## Where the information comes from

Each source is one of these types. The panel and the agent read only documented feeds and databases:

| Type | What it is | Used for | Documentation |
|---|---|---|---|
| OS and package scan | The agent scans installed packages, lockfiles and container images against OSV (`POST /v1/querybatch`, `GET /v1/vulns/{id}`) | Lockfiles, container images, OS packages | https://google.github.io/osv.dev/api/ |
| Vendor feed | The maker's own security feed or its database | WordPress core (WordPress News, Security category RSS), WordPress plugins and themes (WPVulnerability, a public database of WordPress vulnerabilities), and each app's security feed read by Zefily (for example the release notes and changelog of the app) | https://wordpress.org/news/category/security/feed/ and https://docs.wpvulnerability.com/ |

Zefily matches a finding to its source by the version you have, so an advisory that does not affect your version is not
listed. An advisory that Zefily cannot read is reported to its team rather than silently skipped.

## Installed versions of one-click apps and stacks

A security fix for an app is listed on a site only while the site runs a version below the fixed one. The site's
installed version is read the way the app documents it. Where the app documents no way to read it, the Updates page
says **version not readable** and the finding stays until the site is updated and Zefily closes the advisory. Zefily
never guesses a version.

| App | Installed version read from | Documented in | Granularity |
|---|---|---|---|
| Nextcloud | `occ status` (`versionstring`), run by the agent in the stack's app container as `www-data`, daily | https://docs.nextcloud.com/server/latest/admin_manual/occ_command.html | full version. Needs the agent release that adds the `app.version` job |
| Ghost | the site endpoint `GET /ghost/api/admin/site/` (field `site.version`), read over HTTPS, unauthenticated | https://docs.ghost.org/admin-api/site/overview.md | major.minor only, so a patch-level fix cannot be confirmed |
| Uptime Kuma | the image tag the site runs, only when it is pinned (`2.x.x`, with the `-slim` or `-rootless` suffix). The moving tags (`2`, `latest`, `next`) do not name a version, so they show **version not readable** | https://github.com/louislam/uptime-kuma/wiki/Docker-Tags ("2.x.x: Version pinned to a specific release"; "2: Latest version of v2") | exact, when pinned |
| Supabase (self-hosted) | not readable: the self-hosted docs name no version command or endpoint (their installer writes a `.supabase-version` file, which Zefily's stack does not write) | https://supabase.com/docs/guides/self-hosting/docker | none |

For lockfile packages and container images, the fixed version comes from OSV's own record of the vulnerability (the
`fixed` event of the affected range that contains the installed version, https://github.com/ossf/osv-schema/blob/main/docs/schema.md,
read from https://google.github.io/osv.dev/api/). It is shown only from `SEMVER` ranges, for npm, Composer (Packagist) and Go packages; for other ranges and
ecosystems it stays unknown.

## Who is told, and how

Owners and admins of the organization are told about each new finding once:

- **In the panel** (the bell and the Updates page): always. This cannot be switched off while the site or server exists.
- **By e-mail**: for security fixes, on by default.
- **To your external channels** (webhooks, Slack, Discord, Telegram, PagerDuty, Opsgenie): the event `update.security`,
  on by default. A webhook endpoint that you create gets it as well.

Other updates (a newer WordPress plugin, a package update) are told in the panel, once. They do not send e-mail or
external events.

Security fixes are not forgotten: while a security finding stays open, it is repeated once a week, as one reminder
that lists what is still open. A finding that is applied, or that Zefily no longer reports, is closed and not repeated.

### Switching off e-mail and external notices

You can switch off security notices by e-mail and to external channels, but only after you accept the responsibility
yourself. Go to **Settings → Webhooks**, choose **Switch off for e-mail and external channels**, read the statement,
tick that you accept it and confirm your password. Zefily records your name and the time, and the change is in the
activity log. From then on:

- the in-panel notices and the Updates page still show every finding;
- no security e-mail is sent, and no `update.security` event goes to your channels. An endpoint can no longer drop the
  event until the switch-off is accepted;
- you are still responsible for applying the fixes.

**Switch security notices back on** undoes it at any time, without anything to accept. Another owner or admin sees the
same state on the same page.

## Good to know

- WordPress updates are applied from the WordPress page. Each update takes a snapshot first and restores the site when
  it breaks. An app is updated from the site (Deploy now, or Update for an app stack).
- The check runs twice a day, after the security watch. Run a check on the WordPress page for an answer now.
- A finding for an app stays until the fix is out and Zefily closes its advisory, because the app's version on your site
  is not always known to Zefily.

---
Source: https://zefily.com/docs/security-updates-and-notices