system.exposed

What this is

system.exposed tracks the threats that matter and translates them into action. We publish four things:

Who it's for

Defenders, builders, and the security-curious. If you run infrastructure, ship software, or just want to stop reusing that one password — you're in the right place. No vendor fearmongering, no engagement-bait, no trackers.

How we work

Most of what you read here is produced by an automated newsroom we built and run ourselves. Every hour it reads a curated set of primary sources — vendor advisories, CISA's Known Exploited Vulnerabilities catalog, NVD, breach notifications, and the security press — clusters the day's stories, and drafts original write-ups in our house voice. Severity is never the model's opinion: it is computed from CVSS and CISA data. Every draft then goes through a separate, adversarial fact-check pass that compares each claim against the cited sources; anything unsupported is cut or held for a human editor. Posts carry a disclosure at the bottom saying exactly that.

We link to every source we used and never reproduce their text. If a fact isn't in the sources, it isn't in the post — and where the sources disagree or go quiet, we say so. Corrections: corrections@system.exposed.

The site is static, sets zero tracking cookies, and the newsletter goes out over plain transactional email. Your address is used for the newsletter and nothing else.

Responsible disclosure: found something exposed on our own infrastructure? Email hello@system.exposed. We read every report.