Privacy

No accounts, no email list

AI Sec Watch has no user accounts and does not collect email addresses. Every page, feed and API endpoint is public and works without signing in. An earlier email newsletter has been discontinued and its subscriber records removed.

What the server records

• Rate limiting. Requests to the API, the feedback form and the dataset export are counted per client address in memory for up to one hour so that one client cannot exhaust the service. The address itself is not written to the database.
• Download counts. When the dataset is exported, the site stores the format, the filters used, the record count, the browser's user-agent string and a salted one-way hash of the client address. The hash lets us estimate how many distinct users download the data; it cannot be turned back into an address.
• Feedback. A report that an item is misclassified stores the item, the reason, any comment you type and the same salted hash, used only to limit abuse.
• Webhooks and push tokens. If you register a webhook or a device for push notifications, the destination URL or token is stored so that deliveries can be made. Delete the registration through the same API, or stop the app, and the record is no longer used.
• Hosting logs. The hosting provider keeps standard request logs (address, path, time, status) for a short period for operations and abuse prevention.

Analytics

The site counts page views itself, without cookies and without any third-party analytics service. Each view stores the date, the page path, the referring website's host name (for example news.ycombinator.com) and a visitor hash. The hash is computed from a server secret, the date, the client address and the browser's user-agent string, so it changes every day: the site can count distinct visitors per day but cannot recognize a returning visitor on a later day or recover the address. Requests from automated clients, and browsers that send Do Not Track or Global Privacy Control signals, are not counted. Raw page views are kept for at most 13 months.

Third-party content

Records on this site are collected from public sources (vulnerability databases, advisories, research repositories and news outlets). Each record links to its source. Summaries and labels are generated by an automated classifier and may contain errors; use the feedback button on an item to report one.

Cookies and local storage

The site sets a cookie only for the administrator login. Your theme preference is kept in your browser's local storage and never sent to the server. Files you send to Stack Check are processed in memory and not stored; with the vulnerability lookup on, their package names and versions are sent to OSV (osv.dev) to find matching advisories.

Questions

Contact details are on the maintainer's site linked in the footer. Licenses for the dataset, the live service and the code are on the terms page; citation details are on the dataset page.