Global Hack Map

Every hack, exploit and breach, live. Every publicly reported breach, ransomware claim, exploited vulnerability, malicious package and connectivity drop on one globe, each with its sources and an honest status. Check whether you are affected, then fix it in one click.

• Map: incidents placed at the city named in reporting, the organisation's headquarters, or the country, never more precisely than the sources allow.

• New CVEs: a live ticker and an index at /cve of critical CVEs published in the last 72 hours and flaws CISA confirmed exploited this week, minutes after they appear.

• Patch now: the software attackers are using today, one card per product, saying in plain English what can happen, who is affected and what fixes it.

• Am I affected?: pick the apps, products and companies you use and see what attackers are exploiting in them and which have been breached, then get a DeepResearch brief on all of it. Nothing to upload; developers check a repository with their own coding agent.

• One-click fixes: open Claude Code (terminal or web), Codex or Cursor with a runbook for the CVE, or have a coding agent check your systems after a vendor breach. Ask Claude or ChatGPT with the sources attached. Every link only pre-fills the prompt.

• For agents: a read-only MCP server, llms.txt and plain-text fix runbooks at /fix/<CVE>.

Status, honestly

An absent result is never proof that you are safe.

Related MCP server: Cybersecurity Threat Intelligence MCP

Run it locally

Requires Node 20+ and pnpm.

pnpm install
cp .env.example .env.local   # then fill in the values you have
pnpm dev

Open http://localhost:3000. Without a Valyu API key the map still runs on the public feeds; the news layer, AI answers, research reports and plain-English explainers need one.

For the production build locally: pnpm build && pnpm start. The first build runs the live data pipeline once (about a minute); every page is then served from the prerendered cache.

Environment

See .env.example. In short:

Account mode uses signed-in visitors' Valyu credits for their answers and research; shared news and anonymous answers still use the deployment key. The additional account settings above are read by the source but are not included in .env.example.

Deploy

For Vercel, set the environment variables in project settings. vercel.json schedules the news sweep at minute 5 every six hours and the daily brief at 05:30 UTC. Set CRON_SECRET to authenticate those routes. Other hosts need an equivalent scheduler if those jobs are wanted.

next.config.ts enables Cache Components and Partial Prefetching, with per-function cache lifetimes. Paid and rate-limited functions use use cache: remote. No custom remote cache handler is configured here: when self-hosting outside a platform that supplies remote caching, configure a compatible remote cache handler before relying on shared caching across instances.

Production request limits use the official @upstash/redis and @upstash/ratelimit libraries. Configure the two Redis variables before deploying: protected APIs and dynamic lookups return 503 if protection cannot be checked. Development has a bounded, process-local fallback. Add Vercel Firewall rules to reject abuse before functions run.

The Vercel integration's KV_REST_API_URL and KV_REST_API_TOKEN names are supported automatically, so no duplicate UPSTASH_* variables are needed when Vercel supplies that pair. If either explicit UPSTASH_* variable is set, complete that pair; credentials from the two naming schemes are never mixed. The read-only token and TCP REDIS_URL/KV_URL are not used by this HTTP-based limiter.

The snapshot normally revalidates after 10 minutes and public feeds after 15 minutes. These are cache policies, not publication-to-screen guarantees. Upstream delays, timeouts, cached results and fallback data can make the view older or incomplete; check timestamps and original sources.

Development checks

pnpm exec tsc --noEmit
pnpm exec eslint src
pnpm exec vitest run

Browser regressions against pnpm dev: node scripts/test-navigation-interactions.mjs, node scripts/test-responsive-interactions.mjs, node scripts/test-sidebar-interactions.mjs and node scripts/test-mcp.mjs. To verify concurrent counters against an isolated local Redis process, install redis-server/redis-cli and run GHM_REDIS_INTEGRATION=1 pnpm exec vitest run src/lib/http/rate-limit.integration.test.ts.

How it works

• src/lib/sources/* fetch and normalise each feed; src/lib/pipeline.ts geolocates, deduplicates and scores incidents; src/lib/snapshot.ts assembles the cached picture the UI and the MCP server read.

• Next.js 16 with Cache Components and Partial Prerendering: pages are static shells served from the CDN, data is cached per function with use cache (paid and rate-limited calls with use cache: remote, shared across instances), and any URL that was not prerendered gets its shell instantly while its content streams in. See the caching rules in AGENTS.md.

• src/components/map/* draws the globe with native Mapbox GL layers, the data tags and the ASCII Atlas.

• src/lib/stack/* parses manifests and checks them against OSV.

• src/app/api/mcp serves the MCP tools; src/app/fix/[id] renders the agent runbooks.

• Design rules live in DESIGN.md.

Data sources

Spotted a mistake? Open an issue with a source and it will be corrected.

Licence

Code: MIT, see LICENSE. Fonts in src/assets/fonts are under the SIL Open Font License.