Security ledgers: exploited CVEs (CISA KEV + EPSS + NVD), breach disclosures, change feed. Fresh, sourced security facts in one joined shape. Every actively exploited CVE in CISA KEV joined with its EPSS score (FIRST, refreshed daily) and NVD CVSS/CWE/CPE; NVD CVEs (418k, refreshed every 2 hours); organisation-level breach records from Have I Been Pwned plus a Japan disclosure ledger built from company announcements; and a since= change feed of what was added or moved. Every row has a source URL; every response has data_as_of per source. No personal records. Plus an incident ledger: SEC 8-K Item 1.05 cyber-incident filings, Washington and California Attorney General breach notices (7,000+ since 2012, with cause, attack type, residents affected), and CISA / JPCERT / IPA advisories, refreshed daily. Routes: /hot (days, vendor, limit); /kev (vendor, product, since, ransomware, q, limit, offset); /gaps; /stats; /changes (since*, after_seq, face, limit); /vendors (q, limit); /breaches (domain, q, country, since, limit); /cve/{id}; /cwe-trend (top); /incidents (q, country, state, kind, source, attack_type, cve, since, until, limit, offset); /stack-diff (stack*, since); /epss/movers (since, min_delta, direction, vendor, limit); /patch-first (vendor, kev_days, limit); /vendor-card (vendor*); /product-card (product*); /time-to-exploit (vendor, cwe, since); /incidents/trends (months); /ransomware-watch (vendor, days, limit); /incidents/sector-brief (sector, attack_type, months, limit). Paid $0.01 USDC per call via x402 (_meta["x402/payment"]); set sample=true for a free 3-row preview.
ConnectorNo auth
