# pwned.coffee

> Live security incidents: what is affected, whether a fix exists, which versions fix it, and the sources. Updated hourly from CISA KEV, GitHub security advisories and security news, grouped and summarised by a language model, with human review for news-only items.

## Data
- [incidents.json](https://pwned.coffee/incidents.json): live incidents as JSON. Add `?status=past` for older ones, `?stack=<ids>` to filter, and `?since=24h` (or an ISO timestamp) for only what changed.
- [feed.xml](https://pwned.coffee/feed.xml): RSS of live incidents, same filters.
- Incident pages: https://pwned.coffee/i/<id>
- The menu (status by product): https://pwned.coffee/menu/<stack id> (live incidents, history and status for one product)
- Look up a CVE: https://pwned.coffee/cve/<CVE id> redirects to the incident that covers it
- MCP server (streamable HTTP, read-only, no auth): https://pwned.coffee/mcp with tools check_repo(files), todays_specials(stack?), whats_new(since), lookup_cve(id), check_lockfile(content, ecosystem)

## Fields
id, url, title, summary, severity (critical|high|medium|low|unknown), patch_status (patched|partial|unpatched|unknown), exploited (bool), affected, fixed_versions (strings, only when a source states them), ids (CVE/GHSA), stack (ids below), first_seen, updated_at.

## Stack ids
- nextjs: Next.js
- react: React
- node: Node.js
- bun: Bun
- php: PHP
- python: Python
- ruby: Ruby / Rails
- go: Go
- java: Java
- wordpress: WordPress
- drupal: Drupal / Joomla
- magento: Magento
- npm: npm packages
- pypi: PyPI packages
- github-actions: GitHub Actions
- docker: Docker images
- vscode: VS Code extensions
- browser-ext: Browser extensions
- linux: Linux kernel
- openssh: OpenSSH
- nginx: nginx
- apache: Apache httpd
- kubernetes: Kubernetes
- postgres: Postgres
- mysql: MySQL / MariaDB
- redis: Redis
- gitlab: GitLab
- ci: CI servers
- atlassian: Atlassian
- self-hosted: Homelab apps
- paas: PaaS hosts
- cloudflare: Cloudflare
- aws: AWS
- gcp: Google Cloud
- azure: Azure / M365
- vps: VPS providers
- databases-cloud: Hosted databases
- ai-gateways: LLM gateways
- ai-keys: AI API keys
- ml-infra: ML infra
- mcp: MCP servers
- chrome: Chrome
- apple: Apple
- android: Android
- windows: Windows
- office: Microsoft Office
- password-managers: Password managers
- messaging: Chat apps
- crypto-wallets: Crypto wallets
- vpn-edge: VPN & firewalls
- remote-support: Remote access
- vmware: VMware
- erp: Enterprise apps

## How to use this from a coding agent
Fetch incidents.json, then search the current repository's lockfiles, manifests, Dockerfiles, CI workflows and infra config for each incident's affected products and packages. Report the version in use and whether it's in a fixed version. Not security advice: confirm against the vendor advisory linked on each incident page.