Vellaci gibt europäischen Software- und Hersteller vernetzter Produkte ein einziges operatives System für Produkte, SBOMs, Schwachstellen, Vorfälle und CRA-Meldungen. Jede unterstützte Produktversion hat ein SBOM; jede Komponente wird laufend gegen OSV, GitHub-Advisories, CISA KEV und EPSS geprüft. Bestätigt eine namentlich benannte Person, dass ein Ereignis nach Artikel 14 meldepflichtig ist, starten die 24-Stunden-, 72-Stunden- und Abschlussbericht-Fristen ab dieser Entscheidung — und jede Speicherung landet in einem hash-verketteten Audit-Log und einem Beweis-Tresor mit Prüfsummen.
Vollständige Fallstudie auf Englisch lesen →
Das Produkt als System
- Product + SBOM
- Vulnerability match
- Reviewer decision
- Article 14 clocks
- Submission + evidence
Was geliefert wurde
- SBOM ingestion (CycloneDX, SPDX) with continuous matching against OSV, GitHub advisories, CISA KEV and EPSS — exposure becomes a query, not a project
- Article 14 clocks computed server-side from a confirmed awareness time, with the rule version, source timestamp and timezone persisted; statuses and alerts run as background jobs
- Human confirmation before any timer: a named reviewer confirms or rejects reportability with a rationale, so the deadline has an owner and a defensible start
- Immutable revisions — every save is a hashed revision, the submitted one is frozen, amendments link back to it — plus a checksummed evidence vault exportable at any time
- Vulnerabilities ranked by exploitation signal (KEV + EPSS), not alphabetically
- A free 16-question readiness assessment as the top of the funnel: the gap map is shown before an e-mail address is asked for
Screens
Hier belegte Fähigkeiten
Die passende Leistung
- SaaS developer — A complete SaaS product — auth, roles, data, payments, admin, deployment — built for its first real customer.
- Custom web application — Internal tools, client portals, eligibility engines, back offices — the software that replaces the spreadsheet and the emails.
- Architecture and product audit — The paid diagnostic before the build: v1 scope, target architecture, risks, plan and budget. CHF 2’400, seven working days, 100% credited against the build.
Weiterlesen
- Next.js architecture for a production SaaS: the decisions I make on every productWhat separates a Next.js project that holds from one that gets rewritten after a year comes down to about ten decisions. Here are mine, as applied on Atamatax, Horvera, Wabiro, SponsorsMetrics — and on this site.Next.js & Full-Stack9 minLesen →
- Prototype or v1: the difference that decides your launchA prototype impresses in a demo. A v1 survives the first real customer. Confusing them is expensive.Produkte bauen5 minLesen →
Nächstes System
SponsorsMetrics