Sources and validation criteria
We only collect data from public sources, respecting their usage limits and terms. Every displayed fact identifies its source.
| Source | Use | Frequency |
|---|---|---|
| NIST NVD (API 2.0) | Official description, CVSS, CWE, configurations (CPE) and references | Incremental every 2 h + daily reconciliation |
| CVE Program (cve.org) and CISA ADP | Official CNA record, affected versions as the CNA words them, CISA SSVC assessment | On discovery and on every update |
| CISA KEV | Confirmed known exploitation, required action and federal deadline | Every 6 h |
| FIRST EPSS | Estimated probability of exploitation in 30 days | Daily |
| GitHub Security Advisories | Ecosystem packages, version ranges and first patched version | On discovery |
| Alerts (Telegram) | Only as a signal to start an investigation — never as validation | Continuous |
Trust criteria
A record is published automatically only when confirmed by an official source with no conflicts. Source disagreements, products without evidence or CVSS without an identified origin trigger human review.