Trust / Scope / Evidence

Sources and methodology

Version 1 · 17 October 2026. This page describes the public workspace and the limits of its evidence.

What Security8 does

Security8 presents externally observable domain checks alongside CISA Known Exploited Vulnerabilities (KEV) records and attributed third-party security reporting. These are distinct evidence types. A headline is not a verified incident, and a product-name match is not a confirmed vulnerability on your systems.

Exploited vulnerabilities

KEV records come from CISA’s catalogue. Displayed descriptions and required actions retain their source attribution. The homepage searches only the recent records supplied by Security8’s existing feed; total-catalogue counters do not imply that every record is searchable here.

Known exploitation is a prioritisation input. Affected version, configuration, exposure, business impact and available mitigations still matter. CISA-listed due dates are not universal deadlines for every visitor.

Security reporting

The incident feed currently aggregates BleepingComputer and The Hacker News. We link to publishers and label items as reported. Security8 does not independently confirm the underlying allegations. Feed categories and upstream ranking values are not presented as CVSS scores or a global threat index.

Freshness and failures

Each feed has its own last-generated timestamp and independent refresh state. The browser attempts refresh on opening and every five minutes while the page is open. It marks KEV snapshots older than two hours and report snapshots older than 45 minutes as stale. These thresholds describe freshness, not security risk. A successful HTTP response alone does not establish freshness or upstream completeness.

When a refresh fails, the page retains the last available content and states the failure. Without JavaScript, the published fallback is explicitly dated and may be stale. The RSS publication timestamp is separate from the upstream data timestamps.

Scanner scope and scoring

The existing scanner returns a check list, outcomes, score, maximum score and scan timestamp. Read individual observations and error states before interpreting its aggregate grade. A failed connection or an unassessed control is not evidence that a control is absent.

The score is generated by the existing scanner backend. This release does not independently validate its weights or every framework mapping; a grade should not be treated as a calibrated probability of compromise.

See the official Essential Eight assessment process for the distinction between an external observation and an assessment of control implementation and effectiveness.

Result exports and comparisons

The scanner’s browser controls export the returned result as JSON and let you explicitly save a baseline on this device. Baselines retain the domain, scan date, framework and check titles/outcomes; raw observation details are excluded from the stored baseline. Comparisons match check titles and list changes, additions and removals. Renamed checks may appear as a removal plus an addition. A changed outcome is not independently verified remediation.

Privacy and scanning

Product lists and optional scan baselines are stored in browser local storage and can be cleared using the page controls. Shared devices may expose those local preferences. This does not describe the backend’s complete retention policy. Existing scans may have public shareable links; avoid submitting confidential targets or including secrets.

Only scan domains you own or have permission to assess. This release changes presentation and browser tooling; it does not expand the scanner’s network access or test scope.

Corrections

For an inaccurate reported claim, consult the original publisher and record its correction. For Security8 software or documentation issues, use the project issue tracker. Do not post secrets or sensitive vulnerability details in a public issue.