Skip to content

Repository navigation

Security: sazabi/cve.now

Security

SECURITY.md

Security Policy

Reporting a vulnerability in cve.now

If you find a security vulnerability in cve.now itself (the site, feeds, API or MCP server), email security@sazabi.ai. Do not file a public GitHub issue.

We will acknowledge your report within 5 business days and aim to resolve critical vulnerabilities within 90 days. We will coordinate a public disclosure date with you before publishing.

Vulnerabilities in other products

cve.now catalogs vulnerabilities; it doesn't coordinate their disclosure. Report a vulnerability in someone else's software to its vendor or maintainer, or to a CVE Numbering Authority. Please don't post unpatched vulnerabilities in this repository's issues.

Supported versions

cve.now is a hosted service with no releases. We fix the live service at https://cve.now.

Out of scope

  • Vulnerabilities in third-party dependencies (please report upstream; we track and update)
  • Denial-of-service attacks requiring physical or privileged access
  • Errors in upstream vulnerability records (open an issue instead)

There aren't any published security advisories