Your input stays in this tab.

CVE lists, selected files and worksheet notes are processed in your browser. The application does not upload those inputs, call a remote model or send your CVE list to a public scoring API.

What is requested over the network

Your browser requests the site files, self-hosted fonts and a bundled public snapshot from this site's host. Hosting infrastructure may process normal request information such as IP addresses. The Cloudflare-backed host may set a security cookie such as __cf_bm for bot protection; the worksheet itself sets no cookies. Following a source or advisory link navigates to that external publisher.

What is stored

The worksheet uses tab memory, not local storage or a server account. Reloading or closing the page loses your notes. Downloaded JSON and text files remain wherever your browser saves them; they contain your notes without automatic redaction.

Before sharing

Use evidence references rather than secrets. Review hostnames, internal paths, names and configuration details in a report before sharing it outside your intended audience. Clearing the worksheet clears the current input and notes but does not delete files you have downloaded.

No advertising or analytics scripts are included in this product. If that changes, this page and the implementation need review.

Inventory joins and local EPSS

Inventory rows and optional FIRST-format CSV files remain in tab memory. Joined JSON includes original scanner columns, source-text SHA-256 values, filters and public evidence. The digest identifies UTF-8 text as read by the browser, not original file bytes. Exports are unredacted and require review. No CVE or asset is sent to a scoring API.