Contact

Email hello@ziro.sh. One inbox handles everything below, and a person reads it.

Report a correction

A wrong version number costs more trust than a missing record, so corrections come first. Tell us the record id (for example a CVE id), which field is wrong, and a link to the source that shows the right value: a vendor advisory, an OSV entry or a GitHub Security Advisory. Fixes are published as commits that start with correction:.

Suggest a record

If something exploited or high-impact is missing, send the CVE id or the vendor’s own statement. It will be checked against the inclusion rule and two sources before it is published.

Agents and integrations

Questions about the JSON endpoints, the record schema or rate of change belong here too. The API docs and llms.txt answer most of them.

What not to send

Exploit code, proof-of-concept links or undisclosed vulnerabilities. ziro.sh does not publish them and is not a disclosure channel; report a new vulnerability to the affected vendor instead.