https://crakit.eu/blog/Short, practical notes on the EU Cyber Resilience Act for small software makers: scope, SBOM, reporting, documentation. New posts as the rules move.enhttps://crakit.eu/blog/a-gateway-flaw-can-start-your-24-hour-clock/https://crakit.eu/blog/a-gateway-flaw-can-start-your-24-hour-clock/Mon, 28 Sep 2026 08:00:00 +0000A gateway you didn't build can trigger your Article 14 clock once it's actively exploited and your product sits behind it.https://crakit.eu/blog/cisa-s-new-kev-entries-could-start-your-24-hours/https://crakit.eu/blog/cisa-s-new-kev-entries-could-start-your-24-hours/Fri, 25 Sep 2026 08:00:00 +0000CISA's KEV catalog only lists confirmed exploitation. A new entry naming a dependency you ship can start Article 14's 24-hour clock today.https://crakit.eu/blog/security-txt-in-ten-minutes/https://crakit.eu/blog/security-txt-in-ten-minutes/Thu, 24 Sep 2026 08:00:00 +0000RFC 9116 needs three lines. Annex I Part II will require a disclosure contact from 11 December 2027. Here's how researchers use the file.https://crakit.eu/blog/your-sbom-needs-checking-after-you-ship-it-not-just-once/https://crakit.eu/blog/your-sbom-needs-checking-after-you-ship-it-not-just-once/Wed, 23 Sep 2026 08:00:00 +0000The CISA KEV catalog flags dependencies you shipped that are now under active exploitation, the trigger Article 14 cares about.https://crakit.eu/blog/a-paid-tier-can-make-your-open-source-project-a-manufacturer/https://crakit.eu/blog/a-paid-tier-can-make-your-open-source-project-a-manufacturer/Mon, 21 Sep 2026 08:00:00 +0000A donation-funded library stays out of scope under recital 18, but a paid subscription tier makes its maintainer a manufacturer under Article 3(13).https://crakit.eu/blog/selling-from-outside-the-eu-doesn-t-exempt-you-from-the-cra/https://crakit.eu/blog/selling-from-outside-the-eu-doesn-t-exempt-you-from-the-cra/Mon, 21 Sep 2026 08:00:00 +0000A developer based outside the EU selling to European customers is still a manufacturer under Article 3, with the same 24-hour and 72-hour clocks as anyone in thhttps://crakit.eu/blog/the-extension-store-doesn-t-decide-who-s-the-manufacturer/https://crakit.eu/blog/the-extension-store-doesn-t-decide-who-s-the-manufacturer/Fri, 18 Sep 2026 08:00:00 +0000A paid browser extension sold on the Chrome Web Store is still a manufacturer under Article 3(13), no different from selling it yourself.https://crakit.eu/blog/what-your-sbom-has-to-list-under-the-cyber-resilience-act/https://crakit.eu/blog/what-your-sbom-has-to-list-under-the-cyber-resilience-act/Wed, 16 Sep 2026 08:00:00 +0000Annex I asks for top-level dependencies at minimum, from 11 December 2027. What that means for a solo developer shipping one paid product.https://crakit.eu/blog/what-to-tell-your-users-after-you-notify-the-csirt/https://crakit.eu/blog/what-to-tell-your-users-after-you-notify-the-csirt/Tue, 15 Sep 2026 08:00:00 +0000Article 14(8) asks you to inform affected users after an actively exploited flaw. What it requires, what it leaves to you, what to draft now.https://crakit.eu/blog/what-the-crypto-wallet-headlines-mean-for-your-own-app/https://crakit.eu/blog/what-the-crypto-wallet-headlines-mean-for-your-own-app/Mon, 14 Sep 2026 08:00:00 +0000Crypto wallet makers made the headlines today. The articles of the regulation behind that story, and the three questions that decide for you.https://crakit.eu/blog/what-to-have-ready-before-you-open-enisa-s-platform/https://crakit.eu/blog/what-to-have-ready-before-you-open-enisa-s-platform/Sat, 12 Sep 2026 08:00:00 +0000The Single Reporting Platform went live on 11 September 2026. What Article 14 expects you to produce, with the article behind each piece.https://crakit.eu/blog/five-cases-that-decide-if-the-cra-calls-you-a-manufacturer/https://crakit.eu/blog/five-cases-that-decide-if-the-cra-calls-you-a-manufacturer/Fri, 11 Sep 2026 08:00:00 +0000Freelance work, a free tier, a browser-only SaaS, a repo on GitHub, a non-EU seller. Where the CRA stops, with the article for each answer.https://crakit.eu/blog/find-the-actively-exploited-flaws-in-your-dependencies/https://crakit.eu/blog/find-the-actively-exploited-flaws-in-your-dependencies/Thu, 10 Sep 2026 08:00:00 +0000On 11 September the 24 hour clock starts when you know. Here is how to spot an actively exploited dependency in your own project.https://crakit.eu/blog/write-your-24-hour-reporting-procedure-on-one-page/https://crakit.eu/blog/write-your-24-hour-reporting-procedure-on-one-page/Thu, 10 Sep 2026 08:00:00 +0000Article 14 applies from 11 September 2026. The five lines that say who takes the call, who decides, and where the notification goes.https://crakit.eu/blog/saas-with-an-app/https://crakit.eu/blog/saas-with-an-app/Wed, 09 Sep 2026 08:00:00 +0000A browser-only SaaS is outside the Cyber Resilience Act. Add a mobile app, a desktop client or a device that needs your servers, and the picture changes. Here is where the line is, with the article references.