Terms of Use

These terms are a binding agreement between you and the operator of this site, and you accept them by using this site.

If you do not accept them, do not use the site, the feeds, the downloadable data or the API. If you are using it for an organisation, you are stating that you may accept these terms on that organisation's behalf.

You must be old enough to form a binding contract where you live. This site is not directed at children and is not designed for them.

This is a measurement of public documents. It reports what a published security record said when it was published and what it says now, and nothing else.

Nothing here is professional, security, legal or compliance advice, and nothing here is a substitute for the vendor's own advisory or for a scanner. It reports what a published record said and what it says now. It does not know what you run, and it cannot tell you whether you are exposed.

A change shown here is a change to a public record, evidenced by a commit anyone can read in the publisher's own history. It is not an assertion of wrongdoing, negligence or bad faith by any publisher or vendor, not evidence that any fix was incomplete, and not a statement about anyone's systems.

Findings are derived mechanically from public git history. They are not reviewed by a person before publication, they are incomplete by construction, and the boundaries of what was and was not examined are stated on the method page. An absence here is never evidence that nothing changed.

Decisions about patching, risk, disclosure, procurement or compliance are yours. Take them against the vendor's own advisory and your own inventory.

You are solely responsible for verifying anything you rely on against the primary source, and every finding on this site links to the source it came from so that you can.

Each finding names the exact upstream commit it was derived from, in a public repository. Pulling that commit and the record's published state takes about a minute and settles the question without our code and without our agreement. The recipe is on the method page.

Where this site and the publisher's own record disagree, the publisher's record governs. Ours is a derived reading of it.

The service is provided “AS IS” and “AS AVAILABLE”, with no warranty of any kind.

To the maximum extent permitted by applicable law, we disclaim all warranties, whether express, implied, statutory or otherwise, including the implied warranties of merchantability, fitness for a particular purpose, title, non-infringement, accuracy, completeness, quiet enjoyment, and any warranty arising from a course of dealing or usage of trade.

We do not warrant that the service will be uninterrupted, timely, secure or error-free, that any defect will be corrected, that the findings are accurate, current or complete, or that the data reflects the state of any record at the moment you read it. Every figure is computed from a dated snapshot of the upstream catalogs and is out of date the moment a publisher edits a record.

No advice or information, whether oral or written, obtained from us or through the service, creates any warranty not expressly stated here.

The upstream catalogs carry their own disclaimers, which travel with the data and are reproduced on the sources page.

Our liability to you is capped, and the categories of loss that actually hurt in this domain are excluded entirely.

To the maximum extent permitted by applicable law, neither the operator of this site nor any contributor to this project will be liable for any indirect, incidental, special, consequential, exemplary or punitive damages, nor for any loss of profits, revenue, goodwill, business opportunity, data or data security, nor for any security incident, breach, intrusion, downtime, remediation cost, regulatory penalty or reputational harm, however caused and on any theory of liability, whether in contract, tort (including negligence), strict liability or otherwise, and whether or not we were advised of the possibility of such damages.

To the maximum extent permitted by applicable law, our total aggregate liability arising out of or relating to the service or these terms will not exceed the greater of the total amount you paid us for the service in the twelve months before the event giving rise to the claim, which for a free service is nothing, and one hundred United States dollars (US$100).

These limits apply even if a limited remedy fails of its essential purpose, and they are a fundamental basis of the bargain: without them, a free public measurement of this kind would not be published at all.

Some jurisdictions do not allow the exclusion of implied warranties or the limitation of liability for certain damages, including death or personal injury caused by negligence, fraud or fraudulent misrepresentation. Where that is so, the exclusions and limits above apply only to the extent permitted in your jurisdiction, and nothing in these terms limits any liability that cannot lawfully be limited. You may have rights that these terms cannot take away.

If your use of this site causes a claim against us, you cover it.

To the maximum extent permitted by applicable law, you will indemnify, defend and hold harmless the operator of this site and the contributors to this project from and against any claim, demand, proceeding, loss, liability, damage, cost and expense, including reasonable legal fees, arising out of or relating to your use of the service, your breach of these terms, your violation of any law or of any third party's rights, any decision you or anybody else takes on the basis of anything published here, and anything you submit to the site.

You are responsible for what you paste. Do not submit anything you are not entitled to submit, and do not submit personal data, credentials, or anything confidential to somebody else. What happens to a submission is described in the privacy notice.

The data is free to use and the boundaries are narrow: do not resell the dataset as a product, do not scrape around the API, and do not attack the site or the people in it.

You may not:

• Resell, relicense or redistribute the findings dataset, or a substantial part of it, as a product or service of your own. Use it, cite it, build on it and quote it freely; do not repackage it and sell it as though it were yours.
• Access the site by automated means beyond the published API and any rate limits, caps or usage terms published with it, or take steps to evade those limits. Bulk data is a download, not a crawl: take the file.
• Attempt to identify any individual from anything published here, re-identify or deanonymise any visitor, or use the site to profile a person.
• Probe, scan, overload, disrupt or attempt to gain unauthorised access to the site, its infrastructure, or any system connected to it, or interfere with anybody else's use of it. Reporting a genuine vulnerability responsibly is welcome and is not a breach of this clause.
• Present the findings as an accusation, as a security assessment of any named organisation, or as our opinion of any vendor, or otherwise misrepresent what a finding is.
• Use the site in any way that breaks the law, infringes anybody else's rights, or breaches the licence terms of the upstream catalogs described on the sources page.

The upstream records belong to their publishers, our code and derived figures are openly licensed, and every mark on the site belongs to whoever owns it.

The CVE catalog, the CISA KEV catalog and the GitHub Advisory Database are published by their own organisations under their own terms, which are reproduced with their attribution requirements on the sources page. Your use of that data is subject to those terms as well as to these.

This site's own code and the figures derived from those catalogs are made available under the licences stated in the repository. Nothing in these terms grants you any right in a third party's trademark, and no vendor, publisher or agency named here has approved, reviewed or endorsed anything on this site.

We may change, suspend or withdraw any part of the service at any time, and we may change these terms.

There is no service level here, no uptime commitment and no promise that a page, a feed, an export or an API route will continue to exist. A watchlist link, a URL or an export format may stop working without notice.

When these terms change, the date at the top of this page changes with them. Continuing to use the site after a change means accepting the revised terms, so if you rely on this service, read this page when the date moves.

You can stop using the site at any time, and we can stop serving it to anyone who breaches these terms.

There are no accounts here, so there is nothing to close. What your own browser remembers is yours to clear, and the privacy notice says how. We may block access, rate limit or refuse service where use breaches these terms or threatens the availability of the site for everybody else. The sections on warranties, liability, indemnity, content and governing law survive any termination.

The governing law and the venue for any dispute are not yet settled and are deliberately not stated here.

Not settled: no governing law and no venue are named in these terms. This clause is a placeholder pending the operator's choice of jurisdiction and a lawyer's review, so nothing on this page should be read as an agreement about where, or under which law, a dispute would be heard.

Until it is settled, any claim is governed by whatever law would apply in its absence, and nothing here waives a right you have under the mandatory law of the place you live.

The usual clauses, and they mean what they say.

Severability. If any provision of these terms is held unenforceable, it is modified to the minimum extent necessary to make it enforceable, or severed if it cannot be, and the rest stays in force.

Waiver. Not enforcing a provision is not a waiver of it, and a waiver on one occasion is not a waiver on any other.

Assignment. You may not assign these terms without our consent. We may assign them to a successor of the project.

No agency. These terms create no partnership, employment, agency or joint venture between you and us.

Entire agreement. These terms, together with the privacy notice, the sources page and the corrections policy linked from them, are the entire agreement between you and us about the service, and they replace anything said about it before.

Everything, including a legal notice, is answered through the dispute page.

Dispute a finding, or send a legal notice → That page carries the corrections policy, the right of reply for any organisation named on this site, and the route a security report takes. A machine-readable copy of the contact routes is at /.well-known/security.txt.