Your SECURITY.md fails 17 of 18 Article 14 checks

The EU Cyber Resilience Act reporting clock started on 11 September 2026 — 24 hours, 72 hours, 14 days, to ENISA and your coordinating CSIRT. Paste your file. Everything below runs in this tab; nothing is uploaded.

Your SECURITY.md, disclosure policy or incident runbook

as of

Findings

Checked one file. Now do the repository. The VS Code extension sweeps every Markdown file in the workspace at once, works out which checks are answered nowhere rather than merely missing from one file, and writes a single dated readiness report you can hand to an auditor.

$29 once · one licence key per person or team seat · One hour of EU product-compliance consulting runs $150-250.

Early warning: 24 hours from awareness — CRA Art. 14(1)(a)
Notification: 72 hours from awareness — CRA Art. 14(1)(b)
Final report: 14 days after a corrective measure is available — CRA Art. 14(2)(c)
Recipients: ENISA and the CSIRT designated as coordinator, via the single reporting platform — CRA Art. 14(1), Art. 16

A document linter, not legal advice and not a conformity assessment. Regulation (EU) 2024/2847, Articles 13, 14 and 16; Annex I Part II; Annex II. More tools: getreadystack.com