CRA Readiness Audit for EU Cyber Resilience Act

Eight lines out of eight in this Dockerfile break the EU Cyber Resilience Act, and the vendor shipping it into the EU still believes the deadline is 2027.

It is not. Since 11 September 2026, Article 14 has required manufacturers of products with digital elements to report an actively exploited vulnerability to ENISA and their national CSIRT with an early warning inside 24 hours, a technical notification inside 72 hours, and a final report inside 14 days. That duty covers products already on the market. The December 2027 date everyone quotes is real, but it is the date for the *remaining* obligations - conformity assessment, CE marking, technical documentation. The reporting clock has already started.

Here is the file, and here is what the check returns:

L1 [error] FROM node:16
           End-of-life Node release. No upstream security fixes, so the duty to
           supply security updates for the support period cannot be met.
           fix: FROM node:22-bookworm-slim
L2 [error] ENV NODE_TLS_REJECT_UNAUTHORIZED=0
           TLS verification off process-wide. Annex I Part I(2): secure by default.
           fix: NODE_EXTRA_CA_CERTS=/path/to/ca.pem
L3 [error] ENV DEFAULT_PASSWORD=changeme
           Annex I Part I(2)(b) forbids a default password outright - one of the
           few CRA requirements written as an absolute, not a risk judgement.
L4 [warn]  RUN apt-get install -y curl
           Unpinned package. The SBOM in your technical documentation drifts from
           what customers actually run. fix: curl=7.88.1-10+deb12u5
L5 [error] RUN curl -k https://updates.example.com/agent.sh | sh
           Unauthenticated code fetch in an update path. Annex I Part I(2)(c).
L6 [error] ENV AUTO_UPDATE=false
           Automatic security updates off in the shipped default state.
L7 [warn]  ENV DEBUG=true
           Debug endpoints leak stack traces and configuration.
L8 [warn]  CMD ["node","--host","0.0.0.0","server.js"]
           Binds every interface. Annex I Part I(2)(d): minimise attack surface.

None of these are exotic. Every one of them is a line somebody wrote on purpose, for a good local reason, and then shipped.

The interesting part is what the free scanners say about this file: nothing. Syft will produce a perfectly good bill of materials for it. Trivy will list the CVEs in the node:16 layer. Neither tool has an opinion about DEFAULT_PASSWORD, because a default password is not a CVE - it is a design requirement in Annex I Part I(2)(b). Neither knows that Article 13(8) sets a five-year floor on your support period, or that a security.txt whose Expires: date has passed is invalid under RFC 9116 and therefore publishes no disclosure channel at all - which is the channel Annex I Part II(5) requires you to have.

That last one is worth dwelling on. Run the check against a typical security.txt:

L1 [error] Contact:
           Empty Contact field. RFC 9116 requires at least one.
L2 [error] Contact: mailto:[email protected]
           Placeholder contact. A researcher who cannot reach you discloses
           publicly instead - and then the 24-hour clock starts from a tweet.
L3 [error] Expires: 2025-06-30T00:00:00.000Z
           Already passed. The whole file is invalid.
L4 [error] Policy: https://your-domain.tld/security-policy
           Still the template domain.

Four errors, and the repository looked compliant because the file existed.

And the rule that catches the belief itself, run against a planning document:

L2 [warn] The CRA applies from 11 December 2027, so there is nothing to do yet.
          Right for most obligations, wrong for Article 14 - which has applied
          since 11 September 2026, and covers products already on the market.

Ask a chatbot when the CRA applies and it will tell you December 2027. It is repeating the most-published sentence, and the most-published sentence is about a different set of obligations than the one with the 24-hour clock.

CRA Readiness Audit is a VS Code extension with 28 rules of this kind. Open a file, run the check, and every line that breaks a requirement comes back with the Annex or Article it fails, the severity, and the corrected value. The file never leaves your machine. That much is free and it is not a demo - nothing is hidden, blurred or counted down, and the open file is finished when the panel is empty.

What is paid is scale: one pass over the whole repository instead of the file that happens to be open, an exported findings report you can keep with the Annex VII technical documentation, and JSON a CI step can fail on so the next commit does not put the default password back. $29 once, per person or team seat, seven-day full refund. For comparison, blended EU engineering-and-consulting effort on CRA work is estimated at around EUR 45 an hour, and the cheapest tooled route published runs EUR 4,000 per project per year.

It does not replace a conformity assessment, and it will not write your technical file. It reads the repository, which is where the evidence for most of Annex I actually lives, and tells you which lines an auditor - or a researcher with your broken security.txt in front of them - is going to find first.