Security
WatchMyCVE is not a vulnerability scanner. Here is exactly what it does and doesn't do to your site.
What we read
- The public page at the URL you add, using normal web requests.
- On some sites, that site's own public script files, to read a version number. We don't follow scripts to other domains.
- We never read anything behind a login.
What we never do
- Probe, attack, or stress your site.
- Send exploit payloads, guess passwords, or submit forms.
- Run your site's JavaScript.
- Reach private or internal network addresses.
When we read it
- When you add a site, and when you choose Detect stack again.
- Requests identify themselves as watchmycve in the User-Agent header, so you can spot them in your logs.
Where the CVE data comes from
- CVE.org for CVE records, CISA KEV for known exploited vulnerabilities, and FIRST EPSS for exploit probability.
- We rely on these public sources, so an error in them can reach an alert. Each alert shows how confident the match is and why it fired.
What we store
- Your GitHub name and email, the URLs you add, the software we detect, and your alerts and notification settings.
- If you use the contact form, your name, email address, and message.
- Data is held on Appwrite Cloud in Frankfurt. Personal access tokens are stored only as hashes.
Reporting a security issue
- Found a vulnerability in WatchMyCVE itself? Email contact@watchmycve.com with the details.
- Give us reasonable time to fix it before you disclose it, don't access or change other people's data, and don't disrupt the service.
- We won't take legal action against good-faith research that follows these rules.