SEC dilution alerts, seconds after the filing.

We read every 424 offering filing on EDGAR and post what it says — with the provenance behind every number.

See plans → How it works

Live: DILUTION alerts free delayed · paid live

🚨 DILUTION ALERT: $VSTM

Form 424B5 (Prospectus Supplement) Filed

Company Name: Verastem, Inc.
Max Aggregate Offering: $249,999,992.75 USD
Shares Offered: 30,937,500
Warrants Included: Yes
Offering Type: Firm commitment
Placement Agent: Not disclosed
Use of Proceeds: Not disclosed
Filing Terms: Last sale $7.45 · Common/ordinary shares
Primary Document: tm2627537-5_424b5.htm

2 of 13 tracked fields read by a model · 5 never stated accession 0001104659-26-115879

a field a language model read (2 here) our arithmetic, not the filing's (0 here)

Plans

Live is what you buy. Free gets you the delayed community feed, the public dataset, and a time-boxed trial.

Chat — Discord & Telegram

CommunityFree

The community channels, running 15 minutes behind. Anyone can join.

Delayed feed in Discord & Telegram
No account, no setup

Free to join

LivePaid

The same channels, live — the alert lands the second the filing does.

Live feed in Discord & Telegram
Role-gated live channels

Get live alerts

Data & API — for programmatic use

TrialFree

Live access to one HTTPS endpoint, time-boxed, plus the public dataset.

1 signed endpoint, live
Full history for the trial window

Free trial

LivePaid

The signed firehose to your own endpoints, plus the full history to gap-fill from.

Up to 2 HTTPS endpoints, live
Full history via /history

Get the firehose

Pricing is set with the first subscribers rather than guessed at here. Only DILUTION is alerted today.

Specs

What's live

DILUTION — primary equity offerings: 424B5, 424B4, 424B1. Alerted the moment the filing appears in EDGAR's feed.

More event types are in the pipeline; a public roadmap will list what is next.

How freshness works

The free feed is 15 minutes behind. The delay is a server-side entitlement enforced on both the push and the read API, so it cannot be reconstructed by polling.

Custom endpoints are HTTPS only today, so we never hold your Discord or Telegram credentials in the clear.

For developers

The live contract. Everything below is real and current; the generated schema is at /docs.

1. Provenance on every field

Every payload separates values from sources — code, llm, or our own arithmetic — and reports unfilled fields honestly.

2. Cursor gap-fill

GET /findings returns the same projection we push, oldest-first. Replay ?since=$CURSOR after a reconnect for zero-miss recovery.

3. Ed25519 signed webhooks

We sign "<timestamp>." + raw_body with our private key; you verify with the public key at /keys. No shared secret to leak.

payload.json read_api.sh verify_webhook.py

{
  "schema": "dilution/v1",
  "event_type": "DILUTION",
  "accession_number": "0001104659-26-115879",
  "ticker": "VSTM",
  "values": {
    "company_name": "Verastem, Inc.",
    "form_type": "424B5",
    "max_aggregate_offering_price": 249999992.75,
    "shares_offered": 30937500,
    "warrants_included": true,
    "offering_type": "Firm commitment",
    "last_sale_price": 7.45,
    "is_dilutive": true
  },
  "sources": {
    "max_aggregate_offering_price": "llm",
    "shares_offered": "llm",
    "last_sale_price": "code",
    "is_dilutive": "code:primary"
  },
  "confidence": {
    "classification_evidence": "moderate",
    "fields": { "total": 13, "from_code": 6, "from_llm": 2, "unfilled": 5 }
  }
}

# Read history & gap-fill - the API key goes in a header, never the URL
curl "https://edgar-api-34u3u5uiha-uc.a.run.app/findings?limit=100" \
  -H "X-API-Key: $EDGAR_API_KEY"

# Replay the cursor until "has_more" is false
curl "https://edgar-api-34u3u5uiha-uc.a.run.app/findings?since=$NEXT_CURSOR" \
  -H "X-API-Key: $EDGAR_API_KEY"

# Register your HTTPS push endpoint (signed - no shared secret to store)
curl -X POST "https://edgar-api-34u3u5uiha-uc.a.run.app/register_endpoint" \
  -H "Content-Type: application/json" \
  -d '{"license_key":"...","url":"https://your-app.example/edgar","event_types":["DILUTION"]}'

import base64, time
from cryptography.hazmat.primitives.asymmetric.ed25519 import Ed25519PublicKey

PUBLIC_KEY = base64.b64decode("<our public key from /keys>")   # 32 raw bytes


def verify(headers, raw_body: bytes) -> bool:
    ts = int(headers["X-EDGAR-Timestamp"])
    if abs(time.time() - ts) > 300:        # reject stale/replayed requests
        return False
    sig = base64.b64decode(headers["X-EDGAR-Signature"].split("=", 1)[1])
    Ed25519PublicKey.from_public_bytes(PUBLIC_KEY).verify(
        sig, f"{ts}.".encode() + raw_body
    )
    return True                            # raises InvalidSignature on mismatch

What we claim — and what we don't

Provenance on every field

Each number says where it came from: read from the document by code, read by a language model, or computed by us. On the card above, amber marks a field a model read, and a dotted underline marks our own arithmetic. Unreadable fields stay empty — never guessed to look complete.

Only `DILUTION` is alerted

Other event types are recorded and will ship in the dataset, but they are not delivered as alerts yet.

Coverage began 13 October 2026

That is when we started recording findings live. Anything before it is issuer filing history, backfilled from EDGAR — not our alert record.

Not the SEC, not advice

We read public filings and tell you what they say; what you do with that is yours. We are not affiliated with the SEC, and this is not investment advice.