Privacy and data handling
What this site does with what you give it, said plainly and in the order you would ask.
The short version
- There are no accounts. EVULNABLE does not create user accounts and does not identify its visitors. Standard operational logs may contain client IP addresses and request paths, as described under “What is collected without you typing anything” below.
- EVULNABLE does not accept scan files. There is no upload on this site, so there is no scan data here to protect, retain or delete.
- Nothing here is sold, shared with data brokers, or used to train anything.
- There is no advertising and no advertising network on any page.
The rest of this page is the detail behind those four lines, including the parts that are less comfortable.
Scan files
This site does not accept scan exports or any other file.
If you want to compare a scan against EVULNABLE's ranking, look up the CVE identifiers on the CVE Lookup page. Only the identifier you type is sent anywhere, and only to the public vulnerability sources named on the Methodology page.
Everything else you can type in
| What you enter | Where it goes |
|---|---|
| A CVE or search term | Sent to public vulnerability databases to run the search. They see the query; that is how a search works. Nothing else about you is attached. |
| A domain you check | Looked up through public DNS and fetched from the domain's own host, so the domain is visible to both. Only public destinations are checked. If the domain publishes a security.txt, it is read and shown on the results page only, not in the CSV or PDF. Scan results are deleted after 30 minutes. |
| Your watchlist | Your browser's local storage, on your device only. It is never sent here, and the Excel and PDF exports of it are built in your browser. Clearing your browser data clears it. |
What is collected without you typing anything
- Server request logs. Every request is logged with the time, the path and the client IP address, as any web server does. These are operational logs, not a profile, and they are not joined to anything you enter. Request logs (IP address and page requested) are kept for a limited time and then overwritten.
- Rate limiting. Requests are counted per IP address to limit abuse, and the counts are discarded.
- A theme cookie, only if you use it. Choosing light or dark stores your choice in a cookie named evulnable_pv_theme on these pages, or evulnable_theme on the pages that carry the older four-preset control. Each holds a color name and nothing else, neither carries an identifier, and no cookie is set unless you change the theme.
- Aggregate analytics. A privacy-focused analytics provider records page views and loading performance. It sets no cookies and does not fingerprint or track visitors between sites. It is the only third-party script on this site.
- Browser error reports. If your browser blocks something on a page, it may report what was blocked, on which page, and your user-agent string. These are read to find bugs.
What not to type
Do not type regulated or contractually restricted information into a search box or the domain checker.
Questions about this
Ask at [email protected]. If you believe the site is doing something other than what this page says, that is a security report, and it will be treated as one.