One stream.
Your subscription.
All sources publish into the same RSS and JSON feed. Follow everything, or narrow your subscription with optional filters. No account or API key is required.
Subscribe
/feed.xml /feed.xml?technology=node-js /feed.xml?type=patch&technology=ruby /feed.xml?cve=CVE-2026-12345
Filter the shared stream
| Parameter | Meaning |
|---|---|
| type | advisory, patch, mitigation, withdrawal or other |
| technology | Normalized product name, e.g. node-js, or a source ID |
| cve | A CVE identifier |
| source | Exact ID from the source catalog |
| limit | 1–100 events |
Filters combine with AND. Source and technology keys are available in event responses. Corrections retain earlier subscription keys, so an update can reach you even if its latest classification changes.
Read the JSON archive
/api/v1/events?after=0&limit=100
{
"schema_version": "1",
"data": [],
"next_after": 0,
"next_before": null
}Process each batch, save next_after, and continue with that cursor and the same filters. Empty batches preserve your cursor. IDs can have gaps. Start a new backfill when changing filters. Without after, results are newest first; use next_before to browse older events.
Understand revisions
advisory_id identifies a source announcement. Each revision has a new event ID and RSS GUID. A system withdrawal corrects an earlier Heist extraction; it does not imply the publisher retracted the announcement. Product and version facts in the payload are supported by source quotations, but machine extraction can still make mistakes.
Delivery and limits
RSS contains the latest 100 matching events by default. Use JSON for full backfill. Public event reads are cached for 60 seconds with a five-minute stale window. Handle 400 for invalid input, 429 for hosting rate limits and 503 for unavailable data; honor Retry-After.