Your SECURITY.md fails 17 of 18 Article 14 checks

It reads a Markdown file — SECURITY.md, a coordinated disclosure policy, an incident runbook — and names every line that will not survive EU Cyber Resilience Act Article 14. Eighteen rules cover the 24-hour early warning, the 72-hour notification, the 14-day final report, the recipients, the two triggers, and the supporting facts an auditor asks for. Each finding carries the article it comes from and one replacement line.

Maintainers and compliance leads at vendors placing software on the EU market, who own the security documents. It is written for the person who will be woken at 3am by an actively exploited vulnerability and needs the runbook to say who to notify, by when, and through which platform. Open-source stewards carry a lighter duty under Article 24; the rules here flag the manufacturer path.

Because they get the two questions wrong that matter most. General assistants still quote 11 December 2027 as the reporting start date — that is when the remaining obligations apply, while reporting has applied since 11 September 2026. They also reuse the GDPR Article 33 runbook, which has a similar 72-hour number but a different recipient and a different trigger. This linter checks your actual file for both mistakes.

Checking the file you have open is free forever, for personal or commercial use, with the complete rule set and no limits. The licence widens the scope: it sweeps every Markdown file in the workspace at once, reports which checks are answered nowhere in the repository, and writes one dated readiness report. The free scope finishes the job of fixing one document.

One hour of EU product-compliance consulting runs $150-250, and reviewing a security policy against Articles 13, 14 and 16 is rarely a single hour. The licence is $29 once, with a 7-day full refund. The linter does not replace counsel on scope or product classification; it removes the mechanical errors before anyone bills you to find them.