api.avakode.com/security/vulndb-public and matches them, on your own server, against what is actually installed and at which version.
How to access: GuardForge > Vulnerabilities. The screen states, in words, which feed it is reading.
Free/PRO: Free. What Pro sells is time, not access: the licensed feed is real time, this one is served with the delay the feed itself declares — seven days at the time of writing. The advisories are public the moment they are issued; withholding them until somebody pays is not a feature boundary.
Notes:
- It is a plain unauthenticated GET. No licence key, no site token, no domain, no list of what is installed — it is the same document for every site on earth, and the matching happens after the download.
- It is conditional: the ETag and Last-Modified come back as
If-None-Match/If-Modified-Since, so an unchanged document costs both sides nothing. - It is a snapshot, so ingesting it replaces the free row set rather than merging into it — advisories are withdrawn, merged and disputed, and a mirror that only ever grows keeps warning about them forever.
- An empty document is refused. On the wire, “this advisory was withdrawn” and “the server had a bad deploy” look identical, and believing the empty one would clear the mirror and print the most reassuring sentence this plugin can print. A document that yields no rows is rejected, the rows already stored stay, the reason is written on the check line, and the ETag is remembered only for a document that was actually accepted.
- Version matching understands the grammar the mirror really emits: a comma is “or” (several windows for one slug),
*is “all versions”, and a hyphen inside a version number —9.0.0-beta.1— is not a range. - When the Pro add-on is installed and switched on, this client does nothing at all, and on the handover it deletes its own rows, its own options and its ETag: two clients writing one table would let the older document overwrite the newer one.
- Known gaps: the free rows carry no
summary(the public endpoint’s whitelist does not send one, so the column shows a dash), and the free feed does not yet contribute a row to the hardening score.