Threat Feeds
The platform cross-references findings against public threat feeds during severity scoring. Feeds are optional: missing keys degrade gracefully and never block a scan.
Scoring feeds
Section titled “Scoring feeds”scoring/threats.py checks findings against:
| Feed | Env key | Purpose |
|---|---|---|
| Google Safe Browsing | SAFE_BROWSING_API_KEY |
Known-bad URLs/phishing |
| URLhaus | URLHAUS_API_KEY |
Malware distribution URLs |
| AbuseIPDB | ABUSEIPDB_API_KEY |
Abusive IPs |
| VirusTotal | VIRUSTOTAL_API_KEY |
Malware/URL detections |
Feed hits add to the finding’s threats list and influence the score.
Infrastructure enrichment
Section titled “Infrastructure enrichment”Domain enrichment can use additional sources when keys are present:
| Source | Env key |
|---|---|
| Shodan | SHODAN_API_KEY |
| SecurityTrails | SECURITYTRAILS_API_KEY |
| Censys | CENSYS_API_KEY |
| HackerTarget | HACKERTARGET_API_KEY |
Behavior without keys
Section titled “Behavior without keys”- Missing keys skip the corresponding check (no error).
- Enrichment degrades to the remaining sources.
- A scan never fails because a feed is unavailable.