Collect
Retrieve structured records from recognised public security sources.
Editorial transparency
How ShellCodeX turns security data into useful intelligence
Sources are the starting point—not the finished page. We apply completeness checks, evidence labels and practitioner-focused analysis before a record is eligible for search indexing.
Primarysources preferred
5/daydefault AI note cap
Humanreview before articles publish
Clearuncertainty labels
01 · Workflow
From source record to indexed page
Every content type follows the same core controls, with stricter evidence requirements for claims that cannot be independently confirmed.
Normalise
Clean identifiers, dates, affected products, sectors and source links.
Score
Evaluate severity, completeness, exploitation and evidence strength.
Explain
Add actionable context without extending claims beyond the source data.
Control
Index useful records; keep incomplete and weak pages out of search.
02 · Sources & treatment
Different evidence receives different treatment
Vulnerability intelligence
NVD records are combined with CVSS, affected-product ranges, CWE, EPSS and CISA KEV status when available.
NVD · FIRST EPSS · CISA KEVBreach records
Have I Been Pwned catalogue data is supplemented with exposure analysis based on account volume and reported data classes.
Have I Been PwnedRansomware claims
ransomware.live entries reproduce attacker-controlled leak-site claims. A listing is never presented as independent confirmation of a breach.
ransomware.live · leak-site evidenceThreat observations
Community feeds such as URLhaus and Feodo Tracker provide time-bound observations, not proof that an indicator remains malicious.
abuse.ch community feedsAI analysis is deliberately limited
ShellCodeX does not generate text for every database row. A single shared daily budget is used only for records likely to add meaningful search and reader value.
- Critical or KEV CVEsKnown exploitation first, then critical severity.
- Large, verified breachesAt least one million exposed accounts and sufficient source detail.
- Evidence-backed ransomware claimsValid organisation context plus a listing URL or screenshot.
Default cap: 5 records per day. The hard application ceiling is 10. Failed calls also count toward the cap to prevent accidental token overspend.
Automation does not equal publication
AI-assisted analyst notes are constrained to supplied structured facts and labelled on the page. Original long-form articles are researched separately and always saved as unpublished drafts.
- Existing topics are checked to reduce duplicate search intent.
- Current claims require source links and practical reader value.
- Titles, metadata, technical claims and code require editorial review.
- Uncertainty must remain visible; ransomware claims stay unverified.