Since 11 September 2026, the EU Cyber Resilience Act requires anyone selling software in the EU - including paid iOS and Mac apps - to report actively exploited vulnerabilities in their products: an early warning within 24 hours, a notification within 72 hours, through ENISA's reporting platform. It also covers app versions already on sale. The practical first question for most of us is "does anything I ship depend on a package with a known exploited vulnerability?" I couldn't find a tool that treats Swift Package Manager as a first-class ecosystem, so I wrote a small open-source one: reads Package.resolved (v1-v3) and Podfile.lock writes a CycloneDX 1.6 SBOM (useful later for the CRA technical documentation) checks each pinned package against OSV, and marks findings as exploited if CISA's KEV list or ENISA's EUVD lists them runs locally, in Xcode Cloud or as a GitHub Action, and only fails the build on exploited issues by default pipx install cra-scan GitHub repo (Apache-2.0, no dependencies) Two things worth knowing: micro and small companies can't be fined for missing the 24-hour early warning (Art. 64), but the 72-hour notification still applies. The rest of the CRA (technical file, support period, CE marking) applies from 11 December 2027, and for most apps it's self-assessment. How are others approaching this? Feedback on missed matches is very welcome, especially for CocoaPods, which the tool can't match yet.