Weekly digest

Weekly security digest

The weekly digest is an opt-in transactional email for org admins. One email per Monday, per subscriber, summarising the past week’s security posture and pointing at the day’s fix list.

What’s in it

Open findings
  Critical: 4
  High:     12
  Resolved in the last 7d: 8
  Past SLA: 1

Top 5 fixable today (EPSS-weighted)
  acme/api: lodash 4.17.20 → 4.17.21 (critical, EPSS 23.4%)
  acme/web: postcss 8.4.18 → 8.4.31 (high, EPSS 12.1%)
  ...

Open the full dashboard: https://frem.sh/acme/_admin/code-security

Subjects are tuned for the inbox: "[fremforge] Weekly security digest — 4 critical, 12 high open". If you see “0 critical, 0 high open” every week, you can unsubscribe without missing anything.

Subscribing

Subscribe yourself (or any teammate) on /<org>/_admin/security — the Weekly digest card lists current subscribers and exposes the subscribe / toggle / unsubscribe actions inline. One row per (tenant, recipient_email) — multiple admins per org can subscribe independently.

Via REST API

Digest subscriptions are manageable on the public API surface — useful when scripting onboarding for a new admin or syncing subscribers with your org directory.

Subscribe POST /api/v1/orgs/:slug/security/digests body: { "recipient_email": "alice@acme.com", "cadence": "weekly" }
Enable/disable PATCH /api/v1/orgs/:slug/security/digests/:id body: { "enabled": false }
Unsubscribe DELETE /api/v1/orgs/:slug/security/digests/:id

Requires a Personal Access Token (PAT) with the policy:write scope:

curl -X POST \
  -H "Authorization: Bearer ${FREMFORGE_PAT}" \
  -H "Content-Type: application/json" \
  -d '{"recipient_email":"alice@acme.com","cadence":"weekly"}' \
  https://frem.sh/api/v1/orgs/acme/security/digests

See the public REST API reference for the full OpenAPI specification.

Cadence

Weekly — default. Email lands Monday 07:00 in the org’s billing timezone.
Daily — premium tier (enterprise plans). Useful during compliance evidence collection windows when MTTR matters.

A finding’s age, severity, EPSS score, and fix-availability are all snapshot at compose time. The same finding can appear on multiple weeks if it stays open — that’s deliberate; the goal of the email is “this hasn’t been fixed yet”, not a one-shot alert.

Privacy

The digest goes through Lettermint (NL, EU sub-processor) like every other transactional email on fremforge. No third-party trackers; the only link target is your own org dashboard.