Vulnerability Spoiler Alert is a monitoring hub that watches popular open-source repositories and uses Claude AI to detect when commits are patching security vulnerabilities, often before a CVE is even assigned. Running on GitHub Actions every six hours, it analyzes commit diffs across projects like Next.js, Django, React, and Grafana, then publishes findings to a retro-themed newspaper-style website with an RSS feed. In the write-up behind the project, Spaceraccoon backtests the idea on React2Shell (CVE-2025-55182), where the patch commit landed about 100 minutes before the CVE was published. He also argues that threat actors are likely doing the same already, and that GitHub’s lack of private pull requests on public repositories makes quiet fixes hard for maintainers. Know about security patches before the CVE drops: what could possibly go wrong?
