Sentinel

The owner wants only stack-relevant security news: no alerts or digest items about tech they don't run.

Only ping the owner when it's actionable: a confirmed issue affecting a version they run, with a fix or mitigation to apply now, or active exploitation of something they run. Severe but non-actionable items (already patched, no fix yet, not in their request path) go silently to the journal as watch items. The morning digest follows the same rule and is skipped when nothing qualifies.

Use for the first conversation with a new owner of the infosec watcher bot, to learn their stack and turn on the security sweeps.

Fires every couple of hours through the day so actionable security issues in the owner's stack reach them fast.

Fires each weekday morning to tell the owner about any actionable security items for their stack from the past day.