FirstSignalSources and attributions
FirstSignal reads public data and links back to it. Here is every source, with the attribution and licence it asks for.
The phone fetches each source directly from its publisher; there is no FirstSignal server in between. News and advisories show the title, a short snippet and a link, never the full text. Source names are plain text: none of these organisations endorses FirstSignal. Where a notice is required, the wording below is the wording the source asks for. The app shows the notices for the data, fonts, icons and libraries it bundles under Settings, About and Licences; this page lists every source.
Data sources
CVE records
CVE records are from the CVE List, published by the CVE Program.
Copyright © 1999-2026, The MITRE Corporation. CVE is a trademark and the CVE logo is a registered trademark of The MITRE Corporation.
Used under the CVE Program Terms of Use (full text below). https://www.cve.org/Legal/TermsOfUse
National Vulnerability Database (NVD)
This product uses the NVD API but is not endorsed or certified by the NVD.
The bundled product picker index is derived from the NVD CPE Dictionary.
NVD terms of use: https://nvd.nist.gov/developers/terms-of-use
CISA Known Exploited Vulnerabilities (KEV) and CISA Vulnrichment
KEV catalogue and Vulnrichment data from the Cybersecurity and Infrastructure Security Agency (CISA), released under CC0 1.0 Universal (public domain dedication). CISA does not endorse FirstSignal.
CISA Known Exploited Vulnerabilities catalogue and CISA Vulnrichment are dedicated to the public domain under the Creative Commons CC0 1.0 Universal Public Domain Dedication. https://creativecommons.org/publicdomain/zero/1.0/
EPSS
Exploit Prediction Scoring System scores by FIRST. See EPSS at https://www.first.org/epss
VulnCheck KEV
Data labelled "VulnCheck KEV" is from VulnCheck Known Exploited Vulnerabilities (VulnCheck KEV), https://docs.vulncheck.com/community/vulncheck-kev, used with attribution. Requests use your own VulnCheck account and are subject to your agreement with VulnCheck.
endoflife.date
End-of-support dates for products you enter in Stack, from endoflife.date (https://endoflife.date), MIT licence (full text in the app, under Licences). The app downloads the whole list, so the request does not name your products. endoflife.date does not endorse FirstSignal.
MITRE ATT&CK®
© The MITRE Corporation. This work is reproduced and distributed with the permission of The MITRE Corporation.
MITRE ATT&CK and ATT&CK are registered trademarks of The MITRE Corporation. ATT&CK version 20.1. Terms of use: https://attack.mitre.org/resources/terms-of-use/
Vendor security advisory feeds
Security advisory feeds from Microsoft (MSRC), Cisco (PSIRT), Fortinet (PSIRT), Palo Alto Networks, Ivanti, Google (Chrome Releases), the Jenkins project and the Drupal Security Team show the title, a short snippet and a link to the vendor's own page; the text belongs to each vendor. Where a vendor's advisory states that a flaw is exploited, FirstSignal records that statement (the CVE ID and which vendor said it) and links to the advisory; it does not copy the advisory. The vendors do not endorse FirstSignal.
National advisory feeds
Advisories from NCSC NZ, the ACSC, NCSC UK and CISA (including ICS advisories) show the title, a short snippet and a link to the publisher, under each publisher's licence (see licences below). The publishers do not endorse FirstSignal.
Vendor advisories and security news
Advisory and news items show the title, a short snippet and a link to the original publisher. Content belongs to its publishers. On-device summaries are generated on your phone for your own reading.
Security news feeds include the SANS Internet Storm Center. Feeds you add yourself are read the same way: title, snippet and link.
Exploit and scanner indexes
Public proof-of-concept, scanner-template and exploit-module indexes are read for metadata only (names, CVE IDs, links). FirstSignal never downloads or runs exploit code. Each project's content is governed by its own licence.
These are the nuclei template index, Metasploit module metadata and the nomi-sec PoC-in-GitHub index.
Built-in snapshot
Each release carries a snapshot of the last 30 days of CISA KEV, CVE record and EPSS data, so the app can show a ranked look-back before its first sync. The attributions above cover it, and the app labels it with its build date until the first sync replaces it. NVD is used only to find candidate CVE IDs; no NVD record text is in the snapshot. News and national advisories are not in it.
Licences
CVE Program Terms of Use
CVE Usage: MITRE hereby grants you a perpetual, worldwide, non-exclusive, no-charge, royalty-free, irrevocable copyright license to reproduce, prepare derivative works of, publicly display, publicly perform, sublicense, and distribute Common Vulnerabilities and Exposures (CVE™). Any copy you make for such purposes is authorized provided that you reproduce MITRE's copyright designation and this license in any such copy.
Disclaimers
ALL DOCUMENTS AND THE INFORMATION CONTAINED THEREIN PROVIDED BY MITRE ARE PROVIDED ON AN "AS IS" BASIS AND THE CONTRIBUTOR, THE ORGANIZATION HE/SHE REPRESENTS OR IS SPONSORED BY (IF ANY), THE MITRE CORPORATION, ITS BOARD OF TRUSTEES, OFFICERS, AGENTS, AND EMPLOYEES, DISCLAIM ALL WARRANTIES, EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO ANY WARRANTY THAT THE USE OF THE INFORMATION THEREIN WILL NOT INFRINGE ANY RIGHTS OR ANY IMPLIED WARRANTIES OF MERCHANTABILITY OR FITNESS FOR A PARTICULAR PURPOSE.
Source: https://www.cve.org/Legal/TermsOfUse
National advisory feeds
Headlines, short excerpts and links from these government feeds are shown under their licences. The publishers do not endorse FirstSignal.
NCSC NZ: content from the National Cyber Security Centre (New Zealand), Crown copyright, licensed under Creative Commons Attribution 4.0 International. https://creativecommons.org/licenses/by/4.0/
ACSC: content from the Australian Signals Directorate's Australian Cyber Security Centre, © Commonwealth of Australia, licensed under Creative Commons Attribution 4.0 International. https://creativecommons.org/licenses/by/4.0/
NCSC UK: contains public sector information from the National Cyber Security Centre licensed under the Open Government Licence v3.0. https://www.nationalarchives.gov.uk/doc/open-government-licence/version/3/
CISA advisories and ICS advisories: works of the U.S. Government, not subject to copyright in the United States.
Fonts, icons and libraries in the app
Atkinson Hyperlegible Next: Copyright 2020-2024 The Atkinson Hyperlegible Next Project Authors (https://github.com/googlefonts/atkinson-hyperlegible-next). This Font Software is licensed under the SIL Open Font License, Version 1.1.
Atkinson Hyperlegible Mono: Copyright 2020-2024 The Atkinson Hyperlegible Mono Project Authors (https://github.com/googlefonts/atkinson-hyperlegible-next-mono). This Font Software is licensed under the SIL Open Font License, Version 1.1.
Material Symbols by Google. Licensed under the Apache License, Version 2.0. You may obtain a copy of the License at http://www.apache.org/licenses/LICENSE-2.0
The full licence texts, and the name, version, copyright and licence of every open-source library the app uses, are in the app under Settings, About, Licences.
This website
This website loads nothing from anyone else: no fonts, scripts, analytics or embeds. Its text and images are FirstSignal's own; the screens on it are from the app, showing replayed public data.