Find the security holes attackers see.Get the exact fix for every one.
Netwarden scans your website and cloud accounts, then writes the exact fix for every problem it finds. Monitoring comes with it.
Hosts
A Linux monitoring agent that also runs a security audit on every host. CPU and memory metrics on one side, CVE matches and SSH posture on the other, in the same daemon.
- Linux servers, containers, and the services on them
- CVE alerts on the packages you have installed
- Custom dashboards on any metric the agent reports
- Email, push, and webhook alerts, routed by severity
Apps
Error tracking and dependency CVE alerts for the apps you ship. Plus lite analytics if you want them. No per-event bills, no SDK that ships its own runtime.
- Sentry-shaped errors with source maps and breadcrumbs
- Daily OSV.dev cross-reference across 8 ecosystems
- Pageviews, custom events, one funnel per project
- Same Bun binary as Hosts. Run it yourself.
One-line install
curl on the server for Hosts, npm or pip for Apps. The agent writes its own config and starts reporting.
Alerts that actually fire
CVE matches on installed packages. Error spikes from your apps. Routed to email, push, or webhook by severity.
Service auto-discovery
On first boot, the agent finds Docker, Podman, MySQL, and PostgreSQL on the box and starts collecting from them.
Self-host or cloud
Run the same Bun binary on a $5 VPS, or sign up and we run it for you. Switching is the same binary, different host.
Paste the curl line. The agent does the rest.
It installs, discovers what is running on the box, and starts shipping metrics. Editing config is optional. If your box has Docker or PostgreSQL on it, those show up on their own.
Run Netwarden on your own hardware in a couple of minutes
One Bun-compiled binary with SQLite inside. No Postgres to run, no Redis to babysit, no outbound calls required. Copy ./server to the box and start it. CVE scanning, dashboards, and alert dispatch all live in the same process. Air-gap it if you want.
What is different here
Open-source agent
You can read what it collects, in Go, on GitHub.
Self-host whenever
If we go away or you stop trusting us, the same binary runs on your hardware.
Built in the US
Small team. No offshore support, no offshore data.
What teams actually use it for
Solo dev shipping a Vercel app
- Drop the JS SDK in once, get fingerprinted errors with source maps
- OSV.dev alerts when your `next` or `react` ships a security patch
- Cookieless pageviews and a single funnel — without analytics bloat
Self-hosted homelab
- One Bun binary, SQLite by default — no Postgres to operate
- Air-gappable: ship the binary, run it, done
- Auto-discovers Docker, Podman, MySQL, and PostgreSQL
WordPress agency
- Drop-in plugin reports core, theme, and plugin versions
- Monitor every client site from one dashboard
- Alerts for outdated PHP, expired SSL, and plugin CVEs
Small SaaS running both
- Same agent reports on the host and on the app running on it
- Pro Hosts plan includes Solo Apps free
- Single binary self-hosts the whole stack
Air-gapped enterprise
- Ship one binary into the secure zone, no outbound calls required
- All security findings, alerts and dashboards run locally
- SQLite by default; bring Postgres only if you want it
Loading pricing plans...