Appcanary

» see appcanary.com as it lived, on the wayback machine

~ the last words ~

The line at the top of the homepage was the whole product in one sentence: do not find out about security vulnerabilities through Twitter or Hacker News. Appcanary put a small agent on your servers, read the list of packages installed there, and mailed you when one of them turned into a published advisory. It covered Ruby gems and the Linux packages underneath them, on Ubuntu through to Amazon Linux, which between them described most of what a 2016 web company was actually running.

Max Veytsman and Phillip Mendonça-Vieira were security consultants before they were founders, and they had already done the unglamorous half of this work in public. They cofounded Rubysec, the volunteer project that maintains the advisory database for Ruby libraries, then built a free tool called Gemcanary on top of it. Appcanary was the paid version of that instinct, extended past one language, and it went through Y Combinator's summer 2015 batch.

It priced like a small tool rather than an enterprise one. Twenty nine dollars a month covered three agents and the top plan was four hundred and ninety nine, with an API you could call from your test suite or ping on every deploy. By 2017 the front page was advertising 53,043 tracked vulnerabilities over hundreds of thousands of packages, which is the only scale figure the company ever published and the kind of number that only goes up.

I have never paid for a dependency scanner. The job one does still shows up in my week, because I work on computer vision that ships onto small flying machines, and the question of which version of which library is physically on the device is not academic out there. Nobody is going to push a patch to it on your behalf. Appcanary's argument was that this is bookkeeping, and that no engineer does bookkeeping voluntarily.

~ the record ~

~ the first of june ~

The post went up on 4 January 2018 under the title "Goodbye Appcanary. Hello GitHub!" and it is unusually direct about why. "At the time, this required placing a bet on building a certain kind of business, and for a variety of reasons that bet didn't work out." No revenue numbers, no soft landing language. Signups closed that day, the service was promised until 1 June so existing customers could get off it, and the two of them went to work on GitHub's security tooling.

~ the feature that replaced it ~

GitHub had announced its dependency graph at Universe in October 2017 and turned on security alerts for vulnerable dependencies the following month, free, on every public repository by default. That is the same alert Appcanary had been invoicing for since 2015, delivered by the place the code already lived, at a price no vendor can match.

Seven weeks after that shipped, the vendor's founders were GitHub employees. The acquisition was never priced in public and nobody pretended it was anything but a hire. That alerting is what grew into the Dependabot pull requests now arriving at people who have never heard of any of this.

~ the post that never came down ~

appcanary.com still answers in 2026, and it is not a parking page. The blog is intact, the yellow bird is still at the top of it, and the January 2018 goodbye is the first entry. A startup that lasted three years left a working website that has now outlived the product by twice its lifetime.

@}-->--

              )
             (_)
            .-'-.
            |   |
            |   |
            |   |
            |   |
          __|   |__   .-.
       .-'  |   |  `-:   :
      :     `---'     :-'
       `-._       _.-'
           '""""""

« previous  ·  random  ·  next »