Security digest

The weekly security digest is a trend report by email: how the organisation’s security posture moved over the last week. It carries counts only, with no individual findings. Individual findings come in the security alert and the daily alert summary.

It is on by default for every member of the organisation: the Weekly digest setting in each person’s notification settings starts on, and each person can turn it off for any organisation. An owner can also subscribe other addresses, such as an auditor’s, under Security › Reports › Notifications (see Subscribing).

What’s in it

Open findings
  Critical: 4
  High:     12
  Resolved in the last 7d: 8
  Past SLA: 1

Newly known exploited: 1
Newly reachable: 2

Security fixes this week
  Pull requests opened: 4, merged: 2, closed without merging: 1

Needs migration (3)

Subjects are tuned for the inbox: "[acme] Weekly security digest — 4 critical, 12 high open".

Owners get links into the security console with each count. Members and outside subscribers get the same counts without links, because the console is owner-only. Only owners get the hosted Renovate Dependencies section and the compliance report PDF, which name repositories and pull requests. An owner can switch on the PDF attachment for the organisation; it is off by default.

Until 20 October 2026 the digest also listed individual findings: the top newly reachable and known-exploited findings, the top fixable upgrades, and the packages needing migration. Those lines are gone. The counts, and the links for owners, remain.

Newly known exploited, newly reachable and security fixes

These sections appear only when there is something to say:

Newly known exploited: how many open dependency findings on a default branch became listed as exploited in the wild by ENISA EUVD or CISA KEV in the last 7 days, or were new and already listed.
Newly reachable: how many open dependency findings had their reachability verdict change from unknown or not reachable to reachable in the last 7 days.
Security fixes this week: how many security fix pull requests were opened, merged, and closed without merging in the last 7 days, deterministic and AI fixes together.

A finding that was fixed since it changed is not listed. The first two come from the same records as the finding alerts, and are in the digest whether or not your organisation has those alerts on.

Needs migration

This section appears only when there is something to say. It counts the packages whose open dependency findings have no fix on the package you use and are fixed only under another one, such as a new module path, major version or package name. No fix pull request is opened for them. The packages and their targets are listed on the dependency findings page, by package. See Needs migration.

Preview

An owner can see the digest the organisation would get now, without sending anything: /<org>/_admin/security/digest-preview, with ?lang=da (or de, fr, nl, sv) for another language.

Subscribing

Subscribe yourself (or any teammate) under Security › Reports › Notifications (/<org>/_admin/security/reports/notifications) — the Security digest card lists current subscribers and exposes the subscribe / toggle / unsubscribe actions inline. The same page holds the finding alerts switch and shows how many webhook destinations and SIEM endpoints receive security events. One row per (tenant, recipient_email) — multiple admins per org can subscribe independently.

Via REST API

Digest subscriptions are manageable on the public API surface — useful when scripting onboarding for a new admin or syncing subscribers with your org directory.

Subscribe POST /_app/api/v1/orgs/:slug/security/digests body: { "recipient_email": "alice@acme.com", "cadence": "weekly" }
Enable/disable PATCH /_app/api/v1/orgs/:slug/security/digests/:id body: { "enabled": false }
Unsubscribe DELETE /_app/api/v1/orgs/:slug/security/digests/:id

Requires a Personal Access Token (PAT) with the policy:write scope:

curl -X POST \
  -H "Authorization: Bearer ${FREMFORGE_PAT}" \
  -H "Content-Type: application/json" \
  -d '{"recipient_email":"alice@acme.com","cadence":"weekly"}' \
  https://frem.sh/_app/api/v1/orgs/acme/security/digests

See the public REST API reference for the full OpenAPI specification.

Cadence

Weekly: the default. The digest goes out in a daily run at 02:30 UTC, once seven days have passed since a person’s last digest, so the weekday depends on when they got their first one.
Daily: available for a subscribed address ("cadence": "daily"). Useful during compliance evidence collection windows.

A count is a snapshot taken when the digest is composed. An open finding is counted again every week while it stays open: the point of the email is “this hasn’t been fixed yet”, not a one-shot alert.

Privacy

The digest goes through Lettermint (NL, EU sub-processor) like every other transactional email on fremforge. No third-party trackers; the only link targets are your own organisation’s console pages, for owners.