# vulnerabilitydata.io

> How AI (closed models, open-weight models and attack harnesses) is changing real-world security outcomes: breaches, losses and disruption, and the vulnerabilities behind them. Every number traces to a named source; gaps are shown as gaps. Every dataset is public JSON with no key.

## Data API

- API index: https://vulnerabilitydata.io/api/v1/index.json
  Lists every dataset with its description, URL, record count, update cadence and provenance. Start here.
- One dataset: https://vulnerabilitydata.io/api/v1/<name>.json, served exactly as the site uses it, with open CORS (Access-Control-Allow-Origin: *).
- Datasets: ai-discovery, ai-incidents, attacker-trends, breaches, conjectures, cve-macro, cwe-types, defender-capacity, hypotheses, instrument-changes, live-ai-credited-cves, live-breaches, live-ca-ag, live-cve-mix, live-hhs-ocr, live-sec-8k, live-tte, outcome-reports, patch-tuesday.
- Rate limit: 120 requests per 60 seconds per IP address. Every answer carries RateLimit-Limit, RateLimit-Remaining, RateLimit-Reset, RateLimit-Policy; over the limit is HTTP 429 with Retry-After in seconds. Unknown paths answer a JSON 404. Details: https://vulnerabilitydata.io/docs/rate-limits
- API reference: https://vulnerabilitydata.io/api

## Command line (agent-first)

- Install: curl -fsSL https://vulnerabilitydata.io/cli/install.sh | sh
  The script refuses the bundle unless its SHA-256 matches the published https://vulnerabilitydata.io/cli/vulnerabilitydata.js.sha256. Needs Node.js 20+ or Bun.
- Catalog: vulnerabilitydata help --json
  Every command, flag, example, JSON output shape, exit code and environment variable, as JSON.
- Commands: datasets, get, hypotheses, ledger, live, sources, update, completion, version, help.
- Piped or with --json, stdout is one JSON document; errors go to stderr as JSON {"error": {"code", "message", "status"?, "retry_after"?, "exit_code"}}. Branch on the exit code or error code, never the message; on exit 4 wait retry_after seconds.
- Exit codes: 0 ok, 1 usage, 4 rate_limited, 5 server.
- CLI reference: https://vulnerabilitydata.io/docs/cli

## Rules the data keeps

- Breach populations are separate series and are never summed.
- An AI tag that depends on a victim noticing AI is a floor, never a share.
- No figure is interpolated: a period with no reliable source is a gap.
- Every figure carries its own source, or is listed in its file's gaps as not yet verified against one. The files are served exactly as the site uses them.

## Pages

- Overview: https://vulnerabilitydata.io/
- Outcomes: https://vulnerabilitydata.io/outcomes
- AI Question: https://vulnerabilitydata.io/ai
- Analysis: https://vulnerabilitydata.io/analysis
- Breaches: https://vulnerabilitydata.io/breaches
- Live: https://vulnerabilitydata.io/live
- CVEs: https://vulnerabilitydata.io/cve
- Patch Tuesday: https://vulnerabilitydata.io/patch-tuesday
- Types: https://vulnerabilitydata.io/types
- Combined: https://vulnerabilitydata.io/combined
- Sources: https://vulnerabilitydata.io/sources
- Method: https://vulnerabilitydata.io/methodology
- About: https://vulnerabilitydata.io/about
- API: https://vulnerabilitydata.io/api