Getting started, and the questions that come back
Five steps to begin, then short answers. Each one says what euvex does today, and where it stops.
1. Uploading a lockfile
Console · Nouveau scan (new scan)
In the console, “Nouveau scan” (new scan). Upload your software's lockfile: package-lock.json (or npm-shrinkwrap.json), pnpm-lock.yaml, yarn.lock, or a CycloneDX SBOM in JSON. Four megabytes at most. Uploading requires an account.
euvex derives the software bill of materials, the SBOM, looks up the known vulnerabilities of each component in OSV.dev, and saves the result under a secret address. The uploaded file is not kept: only the bill of materials is.
The alert address is prefilled with the account's. Any other address first receives a confirmation link, and nothing else until it has followed it.
What the upload does not read
2. Reading a scan's coverage
Scan page · Couverture (coverage)
On a scan's page, the “Couverture” (coverage) column says on how many components the vulnerability question could be asked: the “interrogés” (queried) line, N out of M. It gives the other figures their meaning: “vulnérables 0” (0 vulnerable) means nothing until you know how many were searched.
A component is queried when a source can resolve it: OSV.dev by its package identifier, the purl, from the upload onwards; the NVD by CPE, for those OSV cannot resolve, during scheduled rechecks: every ten minutes for the forty-eight hours after the upload while a component is waiting, then every day. Those no source could query stay “non analysé” (not analysed): often a purl OSV does not index, such as pkg:generic or pkg:conan, with no CPE or exact version for the NVD, or no identifier at all.
Partial coverage.
The counters only cover the components queried: a component not analysed is not a healthy component. The CRA report therefore does not conclude that the whole product is free of known vulnerabilities; a vulnerability found stays found.
The setting that pays off most.
A build chain that can emit distribution identifiers, pkg:deb for example, rather than pkg:generic. The same OpenSSL 3.0.11 returns nothing under the second and seventy advisories under the first, measured on 26 August 2026.
What euvex does not do
3. Linking the scan to a product
Console · Produits (products)
A product is a version of a product line. The product line, the one that carries the CE marking, is recognised by its name: two versions with the same name form a single product line.
In “Produits” (products), section “Déclarer un produit” (declare a product): a name, a version and, if you have one, a scan chosen among the account's scans not linked to any product, or its identifier, the one in the scan's address. On the page of an unlinked scan, “Déclarer ce produit” (declare this product) opens that form already filled in. A scan can also be linked later, from the product's page, section “Scan logiciel” (software scan), or by uploading a scan from that page: it then replaces the current scan. A product carries a single scan.
What it brings.
The RED report takes up the scan's vulnerability verdict, the Machinery report measures the software inventory requirement against it, and the EU declaration of conformity relies on both. Only scans linked to a product are cross-checked against the catalogue of actively exploited vulnerabilities (the Article 14 case).
What it does not bring.
A signature. euvex assembles the declaration and flags what is blocking; it is drawn up under the sole responsibility of the manufacturer, and the signature remains yours.
4. Setting up alerts
Console · Settings · Notifications
Each scan is rechecked once a day: OSV.dev first, then the NVD for the components OSV cannot resolve. A new vulnerability goes into “Alertes CVE” (CVE alerts), whatever the setting.
The “Alert threshold” in the settings decides which emails go out: all severities, high and above, or critical only. An unknown severity passes every threshold, because it is not a low severity. The threshold filters the emails, never the alert inbox.
The email goes to the scan's alert address, once it is allowed to receive: the account's when the account is confirmed, another one once it has followed its confirmation link. Each email carries an unsubscribe link.
What the settings do not do
5. The Article 14 case
CRA, Art. 14 · applicable from 11.09.2026
Article 14 of the CRA requires the manufacturer to notify an actively exploited vulnerability contained in its product, or a severe incident, within three deadlines. For each one, euvex opens a case, tracks the deadlines and prepares the content of the reports, with a printable file.
Automatic opening: when a component of the scan linked to a product is listed in the CISA KEV catalogue of actively exploited vulnerabilities. The cross-check happens when a product is created with a scan, on linking, on uploading from the product's page, and at each daily recheck. The account's address, if confirmed, receives a notice by email. Manual opening, from the product's Article 14 section, for an incident or a vulnerability the catalogue does not know.
Early warning.
Within twenty-four hours of becoming aware.
Notification.
Within seventy-two hours of becoming aware.
Final report.
For a vulnerability, no later than fourteen days after a corrective or mitigating measure is available: a mitigating measure is enough to trigger it. For an incident, within one month after the submission of the notification.
What euvex does not do
Frequently asked questions
Who can see my scans?
Anyone who has a scan's address can see it, without an account: that is what lets you pass it to an auditor. Scan pages are not indexed by search engines. Treat the address like a password.
Is the uploaded file kept?
No. It is read, turned into a bill of materials, then discarded: only the bill of materials and the file's fingerprint are stored.
Which sources does euvex query?
OSV.dev at upload and at every recheck; the NVD, by CPE identifier, for the components OSV does not resolve; ENISA's European database, to attach a vulnerability's European identifier; the CISA KEV catalogue for active exploitation. The details, and the limits of each, are on the Our sources page.
How often does monitoring run?
One pass every ten minutes, and each scan is rechecked once a day. A scan can also be rechecked from its page, at most once an hour: against OSV only, and without an email.
Zero vulnerabilities, so my product is safe?
No. Zero means that no published vulnerability is known to the sources queried for these components. A flaw that is not yet published is not there, by definition.
Is euvex a notified body?
No. The CRA, RED and Machinery questionnaires give a state of readiness, not a conformity assessment, and euvex does not sign the EU declaration of conformity.
How do I get my data back?
In the console settings, “Download my data”: a JSON file with the account, the two-factor authentication status, the open sessions, the settings, the products and their declarations, the reporting cases, the alerts, the action log, your support requests, and for each scan the link to its archive. Each scan can also be downloaded as CycloneDX 1.5, or as an archive of all its revisions.
How do I delete my account, or a scan?
The account is deleted in the settings, with no grace period: the account, its products, its cases and its alerts are erased. Scans are not: they are detached from the account, their alert address is emptied, and they stay readable through their address. To have a scan erased, write to support: the erasure is real, all its revisions go and its link stops working, including the one given to an auditor. It is refused while an Art. 14 reporting case that is still open depends on it: “Clore le dossier” (close the case) first, from “Signalements” (reporting).
All the questions, and the glossary of the terms used here.
Writing to support
From the console, the “Aide” (help) page attaches your account and the page you came from. Without an account, write to contact@euvex.eu. A vulnerability in euvex itself: security@euvex.eu.