Feed status Early access
How the advisory feed is doing.
These figures are measured from the feed's own files, not estimated. The curated items it carries are listed at /advisories, and how the feed works is on the vulnerabilities page.
No feed head has been published to this site. There is no last build, no sequence number and no signing count to report. They appear here when the vendor's builder writes its first head.
What each host can see
- Cloudflare, which serves this site's copy, sees the address of each request and its time. Cloudflare's own analytics keep that per request.
- AWS, which serves the vendor's bucket as the second source, sees the same for requests to it.
- This site counts nothing on /feed/ and writes no log line for it. The vendor's bucket is defined in its template with no access log and no record of reads, so the vendor stores nothing about fetches.
- An install's fetch is designed to run outside any VPC, so its requests come from the AWS region's shared Lambda address pool, and to let a keeper who wants less choose an hourly or daily fetch, or a fetch only on request.
This page shows the copy this site serves. It checks that each file matches the hash the head names. It does not check the signatures, which an install does with keys it already holds.