Monday digest

The email your CTO actually opens on Monday.

Every Monday morning the recipients Bracework maintains get one email — five plain-English paragraphs, one per fix, with the advisory id and the PR that closed it linked inline. Below is the exact envelope they see, rendered from the samemondayDigestEmail()call the cron makes, byte-for-byte.

No dashboard required
Rows: advisory id · ecosystem · range · PR
Lands Mon · 07:30 local
The envelope

Monday · 07:30 local · one email, five bullets.

The header lines (From / To / Subject) the recipient's mail client renders, and the per-fix rows that follow. Pulled from a real week of the Bracework cron, redacted to one sample repo.

Bracework — week of 2026-08-17
Mon · week of 2026-08-17
From:bracework@bracework.appTo:cto@yourco.com, security@yourco.comSubject:Bracework — week of 2026-08-17

Heads up: Heads up: escalation queued for a human call this week.

  • lodash · CVE-2021-23337 (prototype pollution)

    npm/lodash4.17.20 → 4.17.21medium severitymerged

    Prototype-pollution CVE in a transitive path through services/api — patched in place.

    View advisory PR →

  • pyjwt · CVE-2024-53861 (key confusion)

    pypi/pyjwt1.7.1 → 2.8.0high severityPR awaiting

    Key-confusion CVE; CI green on a branch, PR awaiting one reviewer.

    View advisory PR →

  • paste · RUSTSEC-2024-0439 (yanked crate)

    cargo/paste1.0.12 → 1.0.13low severityPR awaiting

    RUSTSEC yanked crate; pin bumped, awaiting sponsor review.

    View advisory PR →

  • webpack · major-bump with 14 transitive changes

    npm/webpack5.88.0 → 5.97.0critical severityescalated

    Major bump with 14 transitive changes — escalation queued for a Monday human call.

The on-screen body

Byte-for-byte the same.

The block below is the literal inline-styled HTML the email helper returns — the same 560pxfont-family: Arial,Helvetica,sans-serifshell, the same escape, the same bullet ordering. What you read is what subscribers receive.

Bracework — week of 2026-08-17 · bracework/template-next

Heads up: 1 escalation this week, awaiting human judgement.

• merged · medium · npm/lodash 4.17.20 → 4.17.21. [PR #42 merged] Prototype-pollution CVE in a transitive path through services/api — patched in place.

• awaiting review · high · pypi/pyjwt 1.7.1 → 2.8.0. [PR #43 awaiting] Key-confusion CVE; CI green on a branch, PR awaiting one reviewer.

• awaiting review · low · cargo/paste 1.0.12 → 1.0.13. [PR #44 awaiting] RUSTSEC yanked crate; pin bumped, awaiting sponsor review.

• escalated · critical · npm/webpack 5.88.0 → 5.97.0. Major bump with 14 transitive changes — escalation queued for a Monday human call.

Next nightly run at 02:30 UTC.

Subject line: Bracework — week of 2026-08-17 ·  copy the raw HTML from the in-app preview at/dashboard/digest.

Postscript

One email, not a dashboard.

Bracework is the per-repo nightly triage layer that ships the Monday digest above to the recipients your security lead authorizes. Starter covers the first cadence on up to five repos. Team adds audit routing. Scale ships priority triage and severity controls. All plans bill per repo, not per seat.

See pricingRequest a pilot

Curious what the data plane looks like under the covers? Skim the install posture at/install, or read what we patched this week on the/changelog.