Read-only radar for people who maintain too many repos
A quiet radar over every repo you maintain.
Repodar shows what every project runs on, where it is deployed, what is end-of-life and what has known vulnerabilities. Then it stays quiet until something changes.
Free while in beta · Open source, AGPL-3.0 · Never writes to a repo
What Echo watches
Three kinds of alerts, and nothing else.
End of life
node 20 EOL
Runtimes, frameworks and base images past or near their end-of-life date, checked against endoflife.date.
Vulnerabilities
guzzlehttp/guzzle 1 high
Known advisories for the exact versions in your lockfiles, from OSV.dev and Packagist. Dev-only dependencies are counted apart.
Majors behind
Laravel 12 1 major behind
Frameworks one or more major versions behind the newest release. Minor updates never show up as noise.
Echo listens to
- GitHub
- Laravel Forge
- Cloudflare
- Vercel
- DigitalOcean
- CI workflows
Every repo, one table
Critical first. Filter with php:8, vuln:high or owner:client, and the URL keeps the view.
How it works
Sign in with GitHub
One click. Repodar creates your account and asks for nothing else yet.
Pick the repositories
Install the GitHub App on your accounts and organizations and choose the repositories Echo may read.
Echo scans
Manifests, lockfiles and workflows are read daily and on every push to the default branch. Platform tokens refine where things really run.
One email when it matters
A digest arrives only when something changed. Most days nothing does, and you hear nothing.
Repodar keeps very little
- Derived metadata only: versions, frameworks, deploy targets and findings.
- The GitHub App reads Contents and Metadata, nothing more.
- Every token you add is encrypted before it is stored.
- Repodar never writes to your repositories.
One calm email
The digest lists what is new, what got worse, what was resolved and which runtimes moved. If nothing changed, it does not arrive.
Free while in beta
Hosted Repodar costs nothing right now, with no repo limit. If that ever changes you will hear it from us first, and self-hosting stays free under the AGPL.
Questions
Does Repodar change anything in my repositories?
No. Repodar is read-only. The GitHub App asks for Contents and Metadata read access on the repositories you pick, and it never opens pull requests, pushes commits or touches your hosting.
What does Repodar store?
Derived metadata only: repository names, detected runtimes and frameworks with versions, the deploy target, dependency names and versions, and the findings. File contents are fetched, parsed in memory and discarded.
Which stacks does it understand?
PHP (composer.json and composer.lock), Node (package.json with npm, pnpm or bun lockfiles) and Go (go.mod), plus version pins such as .nvmrc, .php-version, .tool-versions and Dockerfile base images. Frameworks with end-of-life tracking include Laravel, Symfony, Next.js, Nuxt, Vue, React and Angular.
Where do end-of-life and vulnerability data come from?
End-of-life dates come from endoflife.date. Vulnerabilities come from OSV.dev for npm and Go, and from Packagist security advisories for Composer.
How often will Echo email me?
At most once a day, and only when something changed: a new or resolved finding, a runtime version change, a repository added or removed. Repodar scans daily and again whenever you push to the default branch.
Can I run it myself?
Yes. Repodar is open source under AGPL-3.0 and runs as one Cloudflare Worker with D1, KV and Queues on your own account. The self-hosting guide takes about 30 minutes.