What's new in the platform
Features that went live in the platform, by release date. The list comes from the platform's own feature register and is updated every week.
SBOM export (CycloneDX 1.6, SPDX 2.3, SPDX 3.0.1)
Downloads the SBOM in standard formats; every SPDX 3.0.1 export is validated against the official schema.
Multi-source vulnerability detection
Matches components against NVD, OSV, CVE Program records and vendor advisories (Espressif, Mbed TLS); every finding links to its sources. Warns in the panel and the technical documentation about records NVD leaves without CPE data (Deferred).
Active exploitation evidence (CISA KEV, ENISA EUVD)
A found vulnerability that is on the CISA KEV or ENISA EUVD exploited list is put first and marked as an Article 14 candidate; its EUVD id is added as a source link. The decision stays with the manufacturer.
Internal vulnerability records (no CVE)
Records vulnerabilities of your own software that have no CVE under an internal id; they work like CVEs in VEX, advisories and Article 14.
SBOM quality report (BSI TR-03183-2)
Shows how completely the SBOM fields are filled against BSI TR-03183-2; not a statement of conformity.
Binary hardening and crypto inventory
Shows NX, PIE, RELRO and stack protection, and the type and weaknesses of keys and certificates in the image.
Applied standards and EN 18031
Records the applied standards and the EN 18031 clause assessment and adds them to the technical documentation.
Licence-restricted components
Files of components whose licence forbids reverse engineering get no binary analysis; only package metadata is used, vulnerability matching continues and the documents state the reason.
Source freshness and fallback paths
Vulnerability sources are updated daily; a source that could not be updated is named with its date in the analysis, an alarm is raised and the source's own publication is used when GitHub is unreachable.
Configuration-aware vulnerability filter (ESP-IDF)
Adds a 'not affected' proposal to the VEX draft for vulnerabilities in ESP-IDF parts the product's full sdkconfig does not build; proposals are made only where an option certainly removes the code, and the analyst decides.
Annex I requirement cards and analyst decisions
Shows each essential requirement's state (met, missing, manual, not applicable) with its evidence source; the analyst decides.
User information publication (Annex II)
Previews the Annex II user information and publishes it on a public page after explicit confirmation; every publication is a new version and earlier versions are kept.
Annex VII evidence files
Stores evidence such as test reports and design documents immutably in the vault and links it to the technical documentation.
Supplier SBOM requests
Requests SBOMs from suppliers, compares the received SBOM with the image and records the due diligence.
Product page and readiness path
Shows each product's CRA readiness and next step; tasks are grouped in tabs on the product page.
Documents from a component list (no firmware)
Produces the SBOM and product-level CRA documents from a CSV/XLSX component list, without a firmware upload.
Non-EU manufacturer and economic operators
Records the authorised representative, importers and distributors and writes them into the right places of the documents.
Hardware security as Annex I evidence
Records secure boot, flash encryption and the JTAG/debug port state as Annex I evidence: from what connected devices report or, without devices, from the manufacturer's declaration with an evidence file.
Cybersecurity risk assessment
Guides the Article 13(2)-(3) risk assessment with a threat profile and residual risks, and records its approval.
Product class test
Determines the product's CRA class (default, important I/II, critical) and conformity assessment route through a short questionnaire.
EU declaration of conformity and simplified declaration
Prepares the Annex V declaration of conformity and the Annex VI simplified declaration of conformity as PDF and Word drafts from the recorded manufacturer data.
Vulnerability report form and inbox
Offers researchers a public report form, security.txt and an inbox that records every handling step.
Security advisories (CSAF)
Publishes CSAF security advisories for fixed vulnerabilities; the fixed version must be a released update.
Maintainer notifications
Records that a vulnerability found in an integrated component was reported to its maintainer.
Licence summary
Summarises component licences per version and lists the unknown ones separately.
Support period and end-of-support alerts
Records the product's support period, shows it in the documents and warns as the end approaches.
CLI and GitHub Action
Runs analysis upload, a result gate and SBOM/VEX downloads from your build pipeline.
Article 14 incident and notification workflow
Tracks the 24-hour, 72-hour and final report deadlines, prepares the single reporting platform form and suggests the coordinator CSIRT under Article 14(7). Every submission is archived signed and RFC 3161 time-stamped.
Device SDK (ESP32)
C SDK for enrolment, telemetry, secure updates and anomaly reporting; verified end to end on an ESP32 board.
Manufacturer SBOM import
Takes your build system's SBOM (CycloneDX 1.4-1.7, SPDX 2.2/2.3/3.0), reconciles it with the analysis and monitors its components for vulnerabilities.
Grouping of Linux kernel findings
Groups thousands of kernel findings by subsystem and proposes 'code not in this image' from the kernel configuration.
Signed technical documentation
Produces the Annex VII technical documentation as PDF and JSON, signs it and freezes it with an RFC 3161 time stamp.
Device enrolment and fleet monitoring
Enrols devices with time-limited enrolment codes, monitors telemetry and offline state and alerts on anomalies.
Signed OTA updates
Delivers updates with an ECDSA P-256 signed manifest, blocks downgrades and can require a second approval. In the ESP32 SDK the device verifies the signature, writes to its A/B partition and returns to the previous version if the new image fails its boot self-test.
Firmware analysis and SBOM
Unpacks a firmware image (binary, file system, Intel HEX, S-record and ELF, including Linux ELFs and ESP32 and Arm Cortex-M MCU ELF/AXF files), identifies its components and produces a software bill of materials that states its own gaps.
Prioritisation with EPSS
Ranks findings by CVSS, the FIRST EPSS exploitation probability and active exploitation evidence; every finding shows its EPSS value. The Article 14 flag comes only from confirmed exploitation, never from EPSS.
VEX decisions and CSAF VEX / OpenVEX
Records the analyst's decision for each finding with its rationale and produces CSAF VEX and OpenVEX documents that pass the official validator.
Device security events
Critical events reported by a device (tampering when an OTA signature or digest does not match, stack corruption and memory access violations) and a security counter below the known value automatically open an incident record awaiting triage and send an alert; the decision stays with the analyst.
Embedded secret scan
Finds private keys and credential traces in the image; the analyst marks each as confirmed or a false alarm.
Turkish and English interface and documents
The portal and all documents are available in Turkish and English; the document language is chosen per product.
Planned work that is not in the platform yet is listed in the roadmap on the platform page.