Privacy and data handling
What this site does with what you give it, said plainly and in the order you would ask.
The short version
- There are no accounts. EVULNABLE does not create user accounts and does not intentionally link uploaded scan content to an identified user. Standard operational logs may contain client IP addresses and request paths, as described under What is collected without you typing anything below.
- An uploaded scan is parsed and the original file discarded. What survives lives in this server's memory for 30 minutes after you last touch it, and the container's filesystem is read-only, so it is never written to a disk or a database.
- Uploaded scanner contents are not intentionally transmitted to third-party enrichment services. Enrichment uses public CVE identifiers only — never a hostname, an IP address or an asset name. Processing happens within EVULNABLE's own application infrastructure, subject to the limits of these promises below.
- Nothing here is sold, shared with data brokers, or used to train anything.
- There is no advertising and no advertising network on any page.
The rest of this page is the detail behind those five lines, including the parts that are less comfortable.
If you upload a scan export
This is the one place you can hand over something sensitive, so it gets the most detail.
What happens to the file
It is parsed on arrival and the original bytes are discarded. Only the normalized findings are kept, and they are kept in this server process's memory. Nothing is written to a file, a temporary directory or a database — the container runs with a read-only filesystem, so there is nowhere for it to be written even by accident.
They are released 30 minutes after you last interact with the analysis, when you use Clear uploaded data now, or when the service restarts — whichever comes first.
The link is the key
Once an analysis is running its address contains a long random identifier, and that identifier is the only thing protecting it. There is no account and no password. Anyone who has the link — from your browser history, a copied URL, a screenshot, a shared screen, a bookmark you sync — can open the analysis and download every export from it, including the asset names, hostnames and IP addresses in your upload, for as long as the session lives.
The identifier is long and random, so it will not be guessed. It will be read by anyone you hand it to. Treat the URL the way you would treat the file, and clear the analysis when you are done rather than waiting for it to expire.
What leaves this site
Only public CVE identifiers, and only to the public vulnerability sources named on the Methodology page. A CVE identifier is a public string that says nothing about you. Hostnames, IP addresses, asset names, scanner output, comments and every other column stay here.
Everything else you can type in
| What you enter | Where it goes |
|---|---|
| A CVE or search term | Sent to NIST's public NVD API to run the search. NVD sees the query; that is how a search works. Nothing else about you is attached. |
| A domain in the DNS checker | Resolved and fetched from this server, so the domain is visible to public DNS and to that domain's own host. Only public destinations are checked. |
| An address in the subnet calculator | Nowhere. The arithmetic happens on this server and no request leaves it. |
| Your watchlist | Your browser's local storage, on your device only. It is never sent here, and the Excel and PDF exports of it are built in your browser. Clearing your browser data clears it. |
What is collected without you typing anything
- Server request logs. Every request is logged with the time, the path and the client IP address, as any web server does. These are operational logs, not a profile, and they are not joined to anything you upload.
- Rate limiting. Requests to the expensive endpoints are counted per IP address, in memory, so one visitor cannot crowd out the rest. The counters are discarded continuously and on restart.
- One cookie, only if you use it. Choosing a theme stores your choice in a cookie named
evulnable_theme. It holds a color preset name and nothing else. No cookie is set unless you change the theme. - Aggregate analytics. Cloudflare Web Analytics records page views and loading performance. It sets no cookies and does not fingerprint or track visitors between sites. It is the only third-party script on this site, and it is the only external origin the site's Content-Security-Policy permits.
- Browser policy violation reports. If your browser blocks something the security policy forbids, it may report what was blocked, on which page, and your user-agent string. These are read to find bugs.
The limits of these promises
“Released from memory” is not cryptographic erasure. Python, the operating system, the host, swap, crash dumps and infrastructure logging can all hold copies outside this application's control. That is true of every web service; most simply do not say it.
What follows from that is a judgment only you can make. This site is built to be safe for evaluating a scanner export, checking a month's patches, and deciding what to fix first. If the data is regulated, contractually restricted, or would be damaging in the wrong hands, run the analysis somewhere you control instead. Nothing here is worth that risk, and a page that told you otherwise would be selling you something.