About threat-digest-bot

threat-digest-bot collects publicly available vulnerability and threat information to produce a daily digest for IT staff. Operated by: Origin & Echo

What it collects

• Vulnerability information published by government agencies and vendors (e.g. the CISA Known Exploited Vulnerabilities catalog)
• Public pages linked from that information, such as security advisories
• Planned, not yet active: public Bluesky posts related to vulnerabilities (for example, posts that mention a CVE number). The Bluesky promises below apply once this starts.

What we promise

• We do not store post text. We keep only the post ID, the post URL, the time we saw it, and any URLs and CVE numbers found in the post. We do not store handles, display names or profiles.
• We never quote posts in the digest. Posts are used only as times and counts, such as "reported on Bluesky" or "N related posts".
• We skip posts from accounts that ask not to be shown to logged-out users, and posts with labels asking that they not be shown publicly.
• When a post is deleted, we delete our record of it as soon as we see the deletion.
• When fetching web pages we follow robots.txt. Official data feeds and APIs (such as the CISA catalog) are fetched as their publishers provide them for automated use. We wait at least one second between requests to the same site. We do not fetch pages that need a login, paywalled articles or pages with a CAPTCHA.
• Page content we fetch is deleted within 7 days.
• The bot never posts, follows, likes or sends messages on Bluesky.

Removal requests and contact

To ask us to delete records of your posts or account, to stop collecting them, or for anything else, please email:

• Email: contact@origin-echo.org
• Response time: we reply within 7 days and act on removal requests promptly once confirmed

For requests about a Bluesky account, please include something that identifies it (such as your profile URL). We keep a record of each request and how we handled it.