> ## Documentation Index
> Fetch the complete documentation index at: https://docs.superblocks.com/llms.txt
> Use this file to discover all available pages before exploring further.

# CVE notifications

> Alerts sent to admins and app creators when a new CVE affects a published Superblocks application

export const Alert = ({type, title, children}) => {
  const variant = ["info", "success", "warning", "danger", "note"].includes(type) ? type : "note";
  return <div className={`alert alert--${variant}`}>
      <div className="alert-icon" />
      <div className="alert-content">
        {title && <div className="alert-title">{title}</div>}
        <div className="alert-body">{children}</div>
      </div>
    </div>;
};

Security Center watches published applications for newly disclosed CVEs. When one lands on a package your organization already ships, Superblocks tells the people who can act on it instead of waiting for someone to open the dashboard.

Notifications reach two audiences over two channels:

|                     | In-app (Inbox)               | Email (daily digest)                             |
| ------------------- | ---------------------------- | ------------------------------------------------ |
| **Security admins** | Immediately, per advisory    | Once a day, one email for the whole organization |
| **App creators**    | Immediately, per application | Once a day, one email covering all of their apps |

For where the findings come from and how to fix them, see [CVE detection](/admin/code-security/supply-chain/cve-detection).

## Who receives them

**Security admins** are everyone holding **`policies:view`**, the same permission that opens the org-wide Security Center. The Admin and Owner roles include it by default. They see every affected application in the organization.

**App creators** are the single user who created the application. A creator is notified about their own applications only, and is notified whether or not they hold `policies:view`.

Deactivated users are excluded from both audiences.

<Alert type="info">
  If you hold `policies:view` and you also created an affected app, you get both. That is two Inbox items for the same CVE, and two digest emails that day: one org-wide, grouped by package and advisory, and one covering only your apps, grouped by application.
</Alert>

## When they send

Only **critical** and **high** findings send an alert. Everything else still shows in Security Center.

Inbox updates as new critical and high CVEs land on published apps. The email is one digest per day. It covers new findings since the last digest, not a repeat of yesterday.

## What is included

### In-app: security admins

One notification per package and advisory, listing every application currently affected.

| Field                 | Example                                                                                       |
| --------------------- | --------------------------------------------------------------------------------------------- |
| Title                 | New CVE present in 3 apps: `lodash`                                                           |
| Advisory              | The OSV or CVE identifier, linked to [osv.dev](https://osv.dev)                               |
| Severity              | Critical or High                                                                              |
| Summary               | The advisory description, with **See more** linking to the full record                        |
| Affected versions     | Every installed version across the affected apps                                              |
| Affected applications | Each app name and its creator                                                                 |
| Actions               | **Fix with Clark** per application, and **View in Security Center** filtered to this advisory |

### In-app: app creators

One notification per application, listing the findings detected on that application in this pass.

| Field       | Example                                                             |
| ----------- | ------------------------------------------------------------------- |
| Title       | 2 vulnerabilities detected in Expense Tracker                       |
| Per finding | Advisory ID, severity, `package@version`, summary, and **See more** |
| Actions     | **Fix with Clark** per finding, and **View in Security Center**     |

## Turning notifications on and off

Digest emails are enabled per organization. Contact Superblocks support to turn them on or off.

## Permissions

| Action                                                     | Permission                                                  |
| ---------------------------------------------------------- | ----------------------------------------------------------- |
| Receive the admin in-app notification and admin digest     | `policies:view`                                             |
| Receive the creator in-app notification and creator digest | Be the creator of the application                           |
| Open **View in Security Center** from a notification       | `policies:view`, or edit access on the affected application |
| Use **Fix with Clark** from a notification                 | Deploy access on the target application                     |

## Related

* [CVE detection](/admin/code-security/supply-chain/cve-detection)
* [SBOM](/admin/code-security/supply-chain/sbom)
* [How findings work](/admin/code-security/how-findings-work)
* [Audit logs](/admin/audit-logs)