Your CSAF advisory, checked against all 43 mandatory tests — before the 24-hour clock runs out

It reads a CSAF 2.0 security advisory and runs 43 checks on it: the 32 mandatory conformance tests of section 6.1 and the 11 profile tests of 6.1.27. It resolves the product ID graph, sorts the revision history by date, recomputes CVSS base, temporal and environmental scores from the vector string, and matches CWE names against the MITRE catalogue. Findings land on their line, offline.

Product security engineers and PSIRT members at manufacturers that place software on the EU market. From 11 September 2026 those manufacturers must report an actively exploited vulnerability to ENISA and their national CSIRT within 24 hours, with a technical notification at 72 hours. The advisory that accompanies that report is written inside the same window, usually by one engineer, at speed.

A schema checks shape. It cannot know that a product ID is referenced but never defined, that a base score of 9.1 contradicts its own vector which computes to 9.8, that one product is listed as affected and fixed in the same vulnerability, or that a CWE name does not belong to its ID. The specification states those as mandatory tests precisely because no schema can express them.

Free checks the open advisory completely: all 43 checks, every finding, no watermark, no counter, no hidden result. The licence changes the scope rather than the portion. It adds every advisory in the repository in one pass, an evidence file you keep as CSV, JSON or HTML, a CI checker written into your repository that exits non-zero, and re-check on every save.

Published CRA cost calculators calibrate readiness work at about EUR 45 per hour of blended engineering and consulting effort. Reading a single advisory against the 43 mandatory tests by hand, including recomputing each CVSS vector, takes an engineer most of an hour, and the first CSIRT report is due 24 hours after you learn of the exploit. The licence is $29 once, with a 7-day full refund.