About ziro.sh

ziro.sh is a short list of the vulnerabilities and incidents that matter to working engineers, mapped to package names, affected version ranges and the version that fixes them. It exists because raw feeds like NVD now publish more entries a day than anyone can read. The useful work has moved from reporting vulnerabilities to filtering and structuring them.

Who it is for

• Coding agents that need to answer “does anything exploited this week touch this repo’s dependencies?” They read the JSON endpoints, the Markdown twins of every page, or llms.txt.
• Engineers on call and solo founders who need to know what to patch today, and to which version. They read the weekly page, a record page or the RSS feed.

What gets in

A record enters the feed when any of these is true:

• It is in the CISA Known Exploited Vulnerabilities catalog.
• Its EPSS exploit probability is above 0.5.
• A vendor advisory confirms exploitation in the wild.
• It affects a common stack: Node, Python, PHP, Go, Rust, Postgres, Redis, nginx, Cloudflare, AWS, Vercel or Railway.

Everything else stays out, including most CVEs.

What never gets in

Exploit code, proof-of-concept links and reproduction steps. ziro.sh points you at the fix, not the attack.

How records are made

Public sources only: CISA KEV, OSV.dev, GitHub Security Advisories, NVD and CVE.org, FIRST EPSS and vendor advisories. A pipeline drafts each record from source text, and a person reviews it before it is published. Severity, affected ranges and fix versions must agree across two sources, or the field is left empty. Summaries restate what the sources say and nothing more.

Corrections

The repository is the database, so every change is a commit. Corrections are commits that start with correction:, and the correction rate is published. If you spot a wrong version or a missing fix, see the contact page.

Price

ziro.sh is free. There are no accounts, API keys or paid tiers.

ziro.sh is not affiliated with the CVE Program, MITRE, CISA or any vendor named.