Skip to main content
Security Auditor: checks when each entry of the project’s software stack was last entered, edited or confirmed. It warns after 90 days and fails after 180 days. Both limits can be changed.

Accurate alerts

The CVE and End of Life auditors read the declared stack. If that stack is out of date, their alerts describe software the site no longer runs.

One click to confirm

If an entry is still correct, Still accurate on the project page resets its date without changing it.
This auditor does not fetch the monitored URL. It reads the software stack of the project and the date each entry was last updated.

​
How it works

  1. Read the stack. An empty stack is a WARNING (300): nothing can be audited, and the other stack-based auditors cannot run either.
  2. Read each entry’s date. The date changes when an entry is added, when it is edited, and when an admin clicks Still accurate on the project page. If an entry arrives without a date, the result is ERROR (500) and the age rules do not run.
  3. Measure the age. The age is the number of whole days between the entry’s date and the moment the audit runs.
  4. Apply the thresholds.
    • An entry failDays days old or older (default 180) is a FAIL (400).
    • An entry warningDays days old or older (default 90), but younger than failDays, is a WARNING (301).
    • Each entry gets its own check. The oldest entry is listed first.
  5. Aggregate. ERROR wins, then FAIL, then WARNING. If every entry is younger than warningDays, the result is SUCCESS (200).

​
Preferences

Both preferences are optional and set per URL. A value that is unset, unreadable or not positive uses the default. If warningDays is not smaller than failDays, there is no warning window, so only the FAIL rule applies.

​
What it audits

Every row maps to one checkRule* method and one CheckCode. The audited page is not fetched, so there is no 590 (site blocked) code. Example messages, using the default thresholds:
  • 400: Liferay DXP 7.4 U92 was last reviewed 731 days ago (2024-10-13); the limit is 180 days.
  • 301: nginx 1.25 was last reviewed 120 days ago (2026-06-16); review it every 90 days.
  • 200: All 3 stack entries were reviewed within 90 days (oldest: Liferay DXP 2026.Q1.13 LTS, 42 days).
Each finding carries the same values in data: vendor, product, version, updatedAt, ageDays, thresholdDays, entries, warningDays and failDays.

​
Output documentation

​
Risks and considerations

​
The stack is declared, not detected

  • 37 Audits trusts the stack the project declares. The CVE and End of Life auditors match vulnerabilities and support dates against those versions. If the stack is out of date, those audits can raise false alarms or miss real problems.
  • This auditor does not compare the declared version with what the site actually runs. It only says when someone last looked.

​
What counts as reviewed

  • Adding an entry, editing it, and clicking Still accurate all reset its date. Nothing else does: running other audits, or changing a different entry, leaves the date as it is.
  • Pick thresholds that match how often the site is deployed. A site that ships every week may want a warningDays of 30.