Support

Every 30 minutes it checks CISA's Known Exploited Vulnerabilities catalog, NVD and Red Hat. When a new entry mentions a vendor or product in your stack (as a whole word, in the vendor, product or description), it sends you an alert. The free plan covers up to 3 products in your stack; with ZeroHour Pro you can watch up to 50, or get every exploited vulnerability for any product.

Check that notifications are on in the app (Settings › Push notifications) and in iPhone Settings › Notifications › ZeroHour, then tap "Send a test notification". Exploited alerts are time-sensitive, so allow time-sensitive notifications if you use Focus.

CISA gives US federal agencies a date to patch each exploited vulnerability. ZeroHour shows it as a countdown because it's a good guide for everyone. A passed deadline means the vulnerability has been known to be exploited for a while, so patch it as soon as you can.

Open Settings › Other products and type its name.

A typed name matches anywhere it appears, including descriptions of other products ("upload a crafted .php file" in a WordPress plugin). The tiles match only the vendor and product, so the PHP tile alerts you about PHP itself.

Exploited lists vulnerabilities CISA has confirmed attackers are using right now. Patch these first. All CVEs also includes newly published critical and high vulnerabilities that aren't known to be exploited yet. On the free plan both show your stack; ZeroHour Pro shows every one.

Yes. In Threats, type a product name or a CVE ID like CVE-2025-12345. On the alert page, tap the CVE ID to copy it.

How many items in your stack need patching: the same number as the Status screen. Mark an alert fixed or ignored and it goes down.

Every exploited vulnerability for any product (free alerts cover only your stack), up to 50 products (free covers 3), alerts for new critical CVEs before they're exploited, webhooks for Slack, Teams and Discord, Home and Lock Screen widgets, image share cards for Slack, Teams and email, and no ads.

In the app, open Settings › ZeroHour Pro and tap Restore purchases. To change plans or cancel, tap Manage subscription there, or go to iPhone Settings › Apple Account › Subscriptions › ZeroHour Pro.

In Slack, open Tools › Workflow Builder or create an app at api.slack.com/apps, turn on Incoming Webhooks, choose a channel, and copy the URL that starts with https://hooks.slack.com/services/.

In the channel, open Workflows and pick the template "Post to a channel when a webhook request is received". Copy the URL it gives you (it ends in …logic.azure.com/… or …powerplatform.com/…). ZeroHour sends an Adaptive Card the template can post as is.

In Server Settings › Integrations › Webhooks, create a webhook for a channel and copy its URL (https://discord.com/api/webhooks/…).

Any HTTPS URL gets a JSON POST for each alert. Here’s a real-shaped example:

POST /your-endpoint
Content-Type: application/json
X-ZeroHour-Signature: sha256=3f9a0c…

{
  "event": "zerohour.alert",
  "id": "CVE-2025-61624",
  "cves": ["CVE-2025-61624"],
  "title": "Fortinet FortiOS is under active attack",
  "body": "Exploited in the wild · patch by Nov 6 · CVE-2025-61624\nPath traversal",
  "product": "Fortinet FortiOS",
  "exploited": true,
  "ransomware": false,
  "severity": "CRITICAL",
  "score": 9.8,
  "deadline": "2026-11-06",
  "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-61624",
  "sentAt": "2026-10-23T09:41:00.000Z"
}

When many alerts arrive at once you get one summary instead (“+8 more alerts for your stack”): cves lists them all, and the product fields are null.

Verify the signature

X-ZeroHour-Signature is an HMAC-SHA256 of the raw request body, using the signing secret shown once when you add the webhook. Check it before trusting the request. In Node.js:

import { createHmac, timingSafeEqual } from 'node:crypto';

function fromZeroHour(rawBody, header, secret) {
  const expected = 'sha256=' + createHmac('sha256', secret).update(rawBody).digest('hex');
  return header?.length === expected.length &&
    timingSafeEqual(Buffer.from(header), Buffer.from(expected));
}

Delivery

• Reply with any 2xx status within 10 seconds.
• Redirects aren’t followed, so use the final URL.
• After 10 failed deliveries in a row the webhook pauses. Tap Test in the app to resume it.

In the app, open Settings › Delete my data. See the privacy policy for what's stored.