● watchsong · discloses
watchsong
Vulnerability disclosure as a service: CVE assignment, a disclosure timeline, and CRA reporting guidance for the products you ship.
watchsong is the discloses leg of the platform. The CRA does not stop at release: a manufacturer has to handle vulnerabilities in what it ships, publish advisories, and report actively exploited vulnerabilities and severe incidents to its national CSIRT and ENISA on fixed deadlines. watchsong is where that work happens. CVE assignment depends on Primitive Engineering becoming a CVE Numbering Authority (CNA); that application is not yet granted.
Early-stage
watchsong is in its first phase and not yet generally available. This page describes what it is for and what exists today; it will grow as the service does.
What it does
- Product register. You register the products you ship; everything else hangs off a product.
- CVE assignment. Once the CNA scope is granted, CVE IDs are assigned under it for vulnerabilities in registered products.
- Disclosure timeline. An advisory grows as mitigation proceeds — initial advisory, workaround, fix, post-mortem — and is published on watchsong.io or on your own subdomain.
- CRA reporting guidance. What to report to the CSIRT and ENISA, when, and how; in the managed tier, done on your behalf.
- Embargo by choice. Push-at-publish keeps pre-disclosure data out of watchsong entirely; scheduled release holds it encrypted until the embargo lifts.
What exists today
The building blocks are in place behind the watchsong CLI, ahead of the portal:
| Command | What it does |
|---|---|
watchsong cve validate | Checks a CVE record against the CVE Record Format 5.2.0 and the CNA rules before it is submitted. |
watchsong cve deadlines | The publication deadline for a CVE record: 24 hours as the target, 72 hours at the latest, from disclosure. |
watchsong csaf generate | Generates a CSAF 2.0 advisory from a CVE record and checks it against the standard. |
watchsong cra deadlines | The CRA Article 14 reporting deadlines for a vulnerability or an incident, from the moment you became aware. |
watchsong site build | Builds the public distribution point: advisory pages, the CSAF provider tree, and security.txt. |
watchsong and zegit
The two meet at the release. zegit proves how a release was built and gated; watchsong handles what is found in it afterwards. Each works without the other — watchsong can handle disclosure for any product, however it was built.
Built the way it preaches
watchsong is itself delivered through zegit: every change lands through the gateway with an Attestation of Validation, and its release images are signed by the zegit Control Plane only on a met Tag Request quorum.
Authoritative reference, generated from the component repos. Spot something stale? Tell us.