sources.yaml

# Organisations that publish through more than one feed. Everything one of them says is one
# voice: ACSC's alert and its news item on the same thing are one confirmation, not two
# (worker/pipeline/lineage.py). `names` are how headlines name an agency when relaying it
# ("ACSC warns ...", "... Added to CISA KEV"). Only agencies have them: "Microsoft" in a
# headline is as often the product as the one speaking.
publishers:
  asd:
    name: Australian Signals Directorate
    names: [ASD, ACSC, Australian Cyber Security Centre, Australian Signals Directorate]
  cisa:
    name: CISA
    names: [CISA, Cybersecurity and Infrastructure Security Agency]
  google:
    name: Google
  microsoft:
    name: Microsoft
  mysecuritymedia:
    name: MySecurity Media
  abc:
    name: ABC

# Every source has a `description` (one plain sentence, published on the site's Sources page)
# and a `standing`, the base of its reputation (worker/pipeline/reputation.py):
#   authoritative  government agencies, CERTs, standards bodies, a vendor's own security
#                  advisories about its own products
#   established    national public broadcasters, major newsrooms, long-running specialist
#                  outlets with editorial standards
#   specialist     trade press, vendor research and blogs, respected individual researchers,
#                  academic preprints
#   community      aggregators, social search, personal blogs without editorial review
# docs/wiki/importance-and-reputation.md says how to change one.
sources:
  # FAST Lane: Authoritative advisories & CVE feeds
  - id: acsc_alerts
    name: ACSC Alerts
    description: "Urgent alerts from the Australian Cyber Security Centre (part of ASD) about threats and vulnerabilities affecting Australia."
    standing: authoritative
    publisher: asd
    type: rss
    region: au
    category: advisory
    class: feed
    priority: 1
    lane: fast
    enabled: true
    url: https://www.cyber.gov.au/rss/alerts
    parser: rss
    expected_frequency: monthly
    notes: "Measured over the year to 2026-10-03: median 8 days between alerts, longest 41"

  - id: acsc_advisories
    name: ACSC Advisories
    description: "Advisories from the Australian Cyber Security Centre on significant threats and vulnerabilities, with advice on what to do."
    standing: authoritative
    publisher: asd
    type: rss
    region: au
    category: advisory
    class: feed
    priority: 1
    lane: fast
    enabled: true
    url: https://www.cyber.gov.au/rss/advisories
    parser: rss
    expected_frequency: monthly
    notes: "Measured over the year to 2026-10-03: median 10 days between advisories, longest 47"

  - id: acsc_news
    name: ACSC News
    description: "News from the Australian Cyber Security Centre: announcements, campaigns and updates on its work."
    standing: authoritative
    publisher: asd
    type: rss
    region: au
    category: news
    class: feed
    priority: 2
    lane: fast
    enabled: true
    url: https://www.cyber.gov.au/rss/news
    parser: rss
    expected_frequency: weekly
    notes: "Measured over the year to 2026-10-03: median 5 days between items, longest 21"

  - id: acsc_publications
    name: ACSC Publications
    description: "Guidance and reports published by the Australian Cyber Security Centre for organisations and individuals."
    standing: authoritative
    publisher: asd
    type: rss
    region: au
    category: advisory
    class: feed
    priority: 2
    lane: fast
    enabled: true
    url: https://www.cyber.gov.au/rss/publications
    parser: rss
    expected_frequency: weekly
    notes: "Measured over the year to 2026-10-03: 4 publications, at most 7 days apart"

  - id: cisa_advisories
    name: CISA Advisories
    description: "Cyber security advisories from the US Cybersecurity and Infrastructure Security Agency (CISA), including joint advisories with partner agencies."
    standing: authoritative
    publisher: cisa
    type: rss
    region: us
    category: advisory
    class: feed
    priority: 1
    lane: fast
    enabled: true
    url: https://www.cisa.gov/cybersecurity-advisories/all.xml
    parser: rss
    expected_frequency: daily
    notes: null

  - id: cisa_ics
    name: CISA ICS Advisories
    description: "CISA advisories on vulnerabilities in industrial control systems and operational technology."
    standing: authoritative
    publisher: cisa
    type: rss
    region: us
    category: advisory
    class: feed
    priority: 1
    lane: fast
    enabled: true
    url: https://www.cisa.gov/cybersecurity-advisories/ics-advisories.xml
    parser: rss
    expected_frequency: daily
    notes: Was /ics-advisories.xml, which 404s; CISA serves ICS under the advisories path.

  - id: cisa_news
    name: CISA News
    description: "News releases and announcements from the US Cybersecurity and Infrastructure Security Agency."
    standing: authoritative
    publisher: cisa
    type: rss
    region: us
    category: news
    class: feed
    priority: 2
    lane: fast
    enabled: true
    url: https://www.cisa.gov/news.xml
    parser: rss
    expected_frequency: daily
    notes: null

  - id: cisa_kev
    name: CISA Known Exploited Vulnerabilities
    description: "CISA's Known Exploited Vulnerabilities catalogue: vulnerabilities with evidence of active exploitation, each with a remediation due date for US federal agencies."
    standing: authoritative
    publisher: cisa
    type: json_api
    region: us
    category: advisory
    class: feed
    priority: 1
    lane: fast
    enabled: true
    url: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json
    parser: json_kev
    expected_frequency: hourly
    notes: null

  # FAST Lane: Australian specialist news
  - id: cyber_daily
    name: CyberDaily AU
    description: "Cyber Daily, an Australian news site covering cyber security incidents, policy and industry."
    standing: specialist
    type: rss
    region: au
    category: news
    class: feed
    priority: 2
    lane: fast
    enabled: true
    url: https://www.cyberdaily.au/news?format=feed&type=rss
    parser: rss
    expected_frequency: daily
    notes: Non-standard feed path (not /feed or /rss)

  - id: itnews_security
    name: ITNews Security
    description: "The security section of iTnews, an Australian technology newsroom covering business and government IT."
    standing: established
    type: rss
    region: au
    category: news
    class: feed
    priority: 2
    lane: fast
    enabled: true
    url: https://www.itnews.com.au/RSS/rss.ashx?type=Category&ID=32
    parser: rss
    expected_frequency: daily
    notes: Category ID 32 (not 37 which is Business)

  - id: dta
    name: DTA News and Blogs
    description: "News and blog posts from the Digital Transformation Agency, the Australian Government agency for digital and ICT policy."
    standing: authoritative
    type: rss
    region: au
    category: news
    class: feed
    priority: 2
    lane: fast
    enabled: true
    url: https://www.dta.gov.au/news-and-blogs/latest/feed/all
    parser: rss
    expected_frequency: daily
    notes: Use /feed/all not /rss.xml (which is stale)

  # NORMAL Lane: General security news & analysis
  - id: securitybrief_au
    name: Security Brief AU
    description: "SecurityBrief Australia, a trade news site on security industry news, products and research in Australia."
    standing: specialist
    type: rss
    region: au
    category: news
    class: feed
    priority: 3
    lane: normal
    enabled: true
    url: https://securitybrief.com.au/feed
    parser: rss
    expected_frequency: daily
    notes: null

  - id: acsm
    name: Australian Cybersecurity Magazine
    description: "Australian Cyber Security Magazine, a MySecurity Media trade publication on cyber security news and industry in Australia."
    standing: specialist
    publisher: mysecuritymedia
    type: rss
    region: au
    category: news
    class: feed
    priority: 3
    lane: normal
    enabled: true
    url: https://australiancybersecuritymagazine.com.au/feed/
    parser: rss
    expected_frequency: daily
    notes: null

  - id: asm
    name: Australian Security Magazine
    description: "Australian Security Magazine, a MySecurity Media trade publication on physical and cyber security in Australia."
    standing: specialist
    publisher: mysecuritymedia
    type: rss
    region: au
    category: news
    class: feed
    priority: 3
    lane: normal
    enabled: true
    url: https://australiansecuritymagazine.com.au/feed/
    parser: rss
    expected_frequency: daily
    notes: null

  - id: abc_cyber
    name: ABC News Cyber Security
    description: "Cyber security news from the ABC, Australia's national public broadcaster."
    standing: established
    publisher: abc
    type: rss
    region: au
    category: news
    class: feed
    priority: 3
    lane: normal
    enabled: true
    url: https://www.abc.net.au/news/feed/104475720/rss.xml
    parser: rss
    expected_frequency: weekly
    notes: "ABC topic feed. Checked 2026-10-04: 25 items over 64 days; robots.txt allows /news/feed/"

  - id: abc_ai
    name: ABC News Artificial Intelligence
    description: "Artificial intelligence news from the ABC, Australia's national public broadcaster."
    standing: established
    publisher: abc
    type: rss
    region: au
    category: news
    beat: ai
    class: feed
    priority: 3
    lane: normal
    enabled: true
    url: https://www.abc.net.au/news/feed/13876586/rss.xml
    parser: rss
    expected_frequency: daily
    notes: "ABC topic feed. Checked 2026-10-04: 25 items over 7 days; robots.txt allows /news/feed/"

  - id: triskele
    name: Triskele Labs
    description: "Articles and research from Triskele Labs, an Australian cyber security services company."
    standing: specialist
    type: rss
    region: au
    category: research
    class: feed
    priority: 3
    lane: normal
    enabled: true
    url: https://www.triskelelabs.com/resources/rss.xml
    parser: rss
    expected_frequency: weekly
    # Was daily, so a quiet week demoted it to degraded. Measured 2026-10-31: median 2.3 days between posts, up to 9 (Sep 22 - Oct 22 2026).
    notes: null

  - id: innovationaus
    name: Innovation Australia
    description: "InnovationAus.com, an Australian publication on technology policy, innovation and government digital programmes."
    standing: specialist
    type: rss
    region: au
    category: news
    class: feed
    priority: 3
    lane: normal
    enabled: true
    url: https://www.innovationaus.com/feed/
    parser: rss
    expected_frequency: daily
    notes: null

  - id: thn
    name: The Hacker News
    description: "The Hacker News, a cyber security news site covering vulnerabilities, malware and attacks."
    standing: specialist
    type: rss
    region: global
    category: news
    class: feed
    priority: 3
    lane: normal
    enabled: true
    url: https://feeds.feedburner.com/TheHackersNews
    parser: rss
    expected_frequency: daily
    notes: null

  - id: bleepingcomputer
    name: Bleeping Computer
    description: "BleepingComputer, a technology news site known for its reporting on ransomware, malware and data breaches."
    standing: established
    type: rss
    region: global
    category: news
    class: feed
    priority: 3
    lane: normal
    enabled: true
    url: https://www.bleepingcomputer.com/feed/
    parser: rss
    expected_frequency: daily
    notes: null

  - id: krebs
    name: Krebs on Security
    description: "Krebs on Security, investigative cyber crime reporting by journalist Brian Krebs."
    standing: established
    type: rss
    region: global
    category: news
    class: feed
    priority: 3
    lane: normal
    enabled: true
    url: https://krebsonsecurity.com/feed/
    parser: rss
    expected_frequency: weekly
    # Was daily, so a quiet week demoted it to degraded. Measured 2026-10-31: median 4 days between posts, up to 9 (Sep 8 - Oct 21 2026).
    notes: null

  - id: darkreading
    name: Dark Reading
    description: "Dark Reading, a cyber security news and analysis site for security professionals."
    standing: established
    type: rss
    region: global
    category: news
    class: feed
    priority: 3
    lane: normal
    enabled: true
    url: https://www.darkreading.com/rss.xml
    parser: rss
    expected_frequency: daily
    notes: null

  - id: therecord
    name: The Record
    description: "The Record, a cyber security news publication from Recorded Future News."
    standing: established
    type: rss
    region: global
    category: news
    class: feed
    priority: 3
    lane: normal
    enabled: true
    url: https://therecord.media/feed
    parser: rss
    expected_frequency: hourly
    notes: Low-volume feed (~5 items)

  - id: cyberwire
    name: The CyberWire
    description: "The CyberWire, a cyber security news service publishing daily briefings and podcasts."
    standing: established
    type: rss
    region: global
    category: news
    class: feed
    priority: 3
    lane: normal
    enabled: true
    url: https://thecyberwire.com/feeds/rss.xml
    parser: rss
    expected_frequency: daily
    notes: null

  - id: schneier
    name: Bruce Schneier Blog
    description: "Schneier on Security, the blog of security technologist and author Bruce Schneier."
    standing: specialist
    type: rss
    region: global
    category: analysis
    class: feed
    priority: 3
    lane: normal
    enabled: true
    url: https://www.schneier.com/feed/atom/
    parser: atom
    expected_frequency: daily
    notes: null

  - id: grahamcluley
    name: Graham Cluley
    description: "The blog of security commentator Graham Cluley, on threats, scams and privacy."
    standing: specialist
    type: rss
    region: global
    category: analysis
    class: feed
    priority: 3
    lane: normal
    enabled: true
    url: https://grahamcluley.com/feed/
    parser: rss
    expected_frequency: daily
    notes: null

  - id: sans_isc
    name: SANS Internet Storm Center
    description: "Handler diaries from the SANS Internet Storm Center: daily notes on threats and attack activity seen on the internet."
    standing: specialist
    type: rss
    region: global
    category: analysis
    class: feed
    priority: 3
    lane: normal
    enabled: true
    url: https://isc.sans.edu/rssfeed_full.xml
    parser: rss
    expected_frequency: daily
    notes: null

  # NORMAL Lane: Vendor security blogs
  - id: microsoft_security
    name: Microsoft Security Blog
    description: "Microsoft's security blog: threat intelligence and security news from Microsoft."
    standing: specialist
    publisher: microsoft
    type: rss
    region: global
    category: vendor_advisory
    class: feed
    priority: 3
    lane: normal
    enabled: true
    url: https://www.microsoft.com/en-us/security/blog/feed/
    parser: rss
    expected_frequency: daily
    notes: null

  - id: crowdstrike
    name: CrowdStrike Blog
    description: "Threat research and company news from the blog of the security vendor CrowdStrike."
    standing: specialist
    type: rss
    region: global
    category: vendor_advisory
    class: feed
    priority: 3
    lane: normal
    enabled: true
    url: https://www.crowdstrike.com/en-us/blog/feed
    parser: rss
    expected_frequency: daily
    notes: null

  - id: unit42
    name: Unit 42 Palo Alto Networks
    description: "Threat research from Unit 42, the threat intelligence and incident response team at Palo Alto Networks."
    standing: specialist
    type: rss
    region: global
    category: vendor_advisory
    class: feed
    priority: 3
    lane: normal
    enabled: true
    url: https://unit42.paloaltonetworks.com/feed/
    parser: rss
    expected_frequency: daily
    notes: null

  - id: malwarebytes
    name: Malwarebytes Labs
    description: "Malwarebytes Labs: threat research and consumer security news from the security vendor Malwarebytes."
    standing: specialist
    type: rss
    region: global
    category: vendor_advisory
    class: feed
    priority: 3
    lane: normal
    enabled: true
    url: https://www.malwarebytes.com/blog/feed/index.xml
    parser: rss
    expected_frequency: daily
    notes: null

  # NORMAL Lane: AI security & specialist research (PLAN.md section 5: AI sources are NORMAL)
  - id: simonwillison
    name: Simon Willison Blog
    description: "Simon Willison's blog on large language models, AI tools and prompt injection."
    standing: specialist
    type: rss
    region: global
    category: research
    beat: ai
    class: feed
    priority: 4
    lane: normal
    enabled: true
    url: https://simonwillison.net/atom/everything/
    parser: atom
    expected_frequency: daily
    notes: "AI/tech specialist blog. Up to 1.3 days between posts in the last year"

  - id: embracethered
    name: Embrace The Red
    description: "Embrace The Red, Johann Rehberger's blog on red teaming and attacks on AI systems such as prompt injection."
    standing: specialist
    type: rss
    region: global
    category: research
    beat: both
    class: feed
    priority: 4
    lane: normal
    enabled: true
    url: https://embracethered.com/blog/index.xml
    parser: rss
    expected_frequency: monthly
    notes: "AI red-team research. Median 17, longest 52 days between posts in the last year"

  - id: openai_news
    name: OpenAI News
    description: "OpenAI's own news: product launches, research and safety announcements."
    standing: specialist
    type: rss
    region: global
    category: ai_security
    beat: ai
    class: feed
    priority: 4
    lane: normal
    enabled: true
    url: https://openai.com/news/rss.xml
    parser: rss
    expected_frequency: weekly
    notes: "Median 0.3, longest 11 days between posts in the last year"

  - id: deepmind
    name: DeepMind Blog
    description: "Google DeepMind's blog on its AI research, models and safety work."
    standing: specialist
    publisher: google
    type: rss
    region: global
    category: ai_security
    beat: ai
    class: feed
    priority: 4
    lane: normal
    enabled: true
    url: https://deepmind.google/blog/rss.xml
    parser: rss
    expected_frequency: weekly
    notes: "Median 1.7, longest 21 days between posts in the last year"

  - id: google_security
    name: Google Security Blog
    description: "Google's security posts: news on the security of Google products and its security research."
    standing: specialist
    publisher: google
    type: rss
    region: global
    category: vendor_advisory
    class: feed
    priority: 3
    lane: normal
    enabled: true
    url: https://blog.google/security/rss/
    parser: rss
    expected_frequency: weekly
    # Was daily, so a quiet week demoted it to degraded. Measured 2026-10-31: median 4.8 days between posts, up to 55 (Jun 2 - Oct 21 2026).
    notes: null

  - id: ms_ai_security
    name: Microsoft AI & Security Blog
    description: "Microsoft Security Blog posts on AI and machine learning: securing AI systems and using AI in defence."
    standing: specialist
    publisher: microsoft
    type: rss
    region: global
    category: ai_security
    beat: both
    class: feed
    priority: 4
    lane: normal
    enabled: true
    url: https://www.microsoft.com/en-us/security/blog/topic/ai-and-machine-learning/feed/
    parser: rss
    expected_frequency: weekly
    notes: "Up to 7 days between posts in the feed's 10 items"

  - id: owasp_genai
    name: OWASP GenAI Security
    description: "The OWASP GenAI Security Project, publishing guidance on the risks of generative AI and LLM applications, including the OWASP Top 10 for LLM Applications."
    standing: specialist
    type: rss
    region: global
    category: ai_security
    beat: both
    class: feed
    priority: 4
    lane: normal
    enabled: true
    url: https://genai.owasp.org/feed/
    parser: rss
    expected_frequency: quarterly
    notes: "Median 28, longest 111 days between posts in the last year"

  - id: huggingface
    name: Hugging Face Blog
    description: "The Hugging Face blog on open models, datasets and machine learning tools."
    standing: specialist
    type: rss
    region: global
    category: ai_security
    beat: ai
    class: feed
    priority: 4
    lane: normal
    enabled: true
    url: https://huggingface.co/blog/feed.xml
    parser: rss
    expected_frequency: weekly
    notes: "Median 0.8, longest 14 days between posts in the last year"

  # NORMAL Lane: AI news, safety and policy (beat: ai; docs/wiki/ai-news-beat.md).
  # Each feed and its robots.txt were checked with plain GETs on 2026-10-04.
  - id: verge_ai
    name: The Verge AI
    description: "The Verge's coverage of artificial intelligence."
    standing: established
    type: rss
    region: global
    category: news
    beat: ai
    class: feed
    priority: 4
    lane: normal
    enabled: true
    url: https://www.theverge.com/rss/ai-artificial-intelligence/index.xml
    parser: atom
    expected_frequency: daily
    notes: "Atom; several posts a day, 10 items in the feed"

  - id: techcrunch_ai
    name: TechCrunch AI
    description: "TechCrunch's coverage of AI companies, products and funding."
    standing: established
    type: rss
    region: global
    category: news
    beat: ai
    class: feed
    priority: 4
    lane: normal
    enabled: true
    url: https://techcrunch.com/category/artificial-intelligence/feed/
    parser: rss
    expected_frequency: daily
    notes: "Several posts a day, 20 items in the feed. robots.txt allows all agents but blocks named AI crawlers"

  - id: ars_ai
    name: Ars Technica AI
    description: "Ars Technica's coverage of artificial intelligence."
    standing: established
    type: rss
    region: global
    category: news
    beat: ai
    class: feed
    priority: 4
    lane: normal
    enabled: true
    url: https://arstechnica.com/ai/feed/
    parser: rss
    expected_frequency: daily
    notes: "Median 0.1 days between posts in the feed's 20 items"

  - id: mit_tr_ai
    name: MIT Technology Review AI
    description: "MIT Technology Review's coverage of artificial intelligence."
    standing: established
    type: rss
    region: global
    category: news
    beat: ai
    class: feed
    priority: 4
    lane: normal
    enabled: true
    url: https://www.technologyreview.com/topic/artificial-intelligence/feed
    parser: rss
    expected_frequency: daily
    notes: "Median 0.9, longest 3 days between posts in the feed's 10 items. robots.txt allows all agents but blocks named AI crawlers"

  - id: import_ai
    name: Import AI (Jack Clark)
    description: "Import AI, Jack Clark's weekly newsletter on AI research and policy."
    standing: specialist
    type: rss
    region: global
    category: analysis
    beat: ai
    class: feed
    priority: 4
    lane: normal
    enabled: true
    url: https://importai.substack.com/feed
    parser: rss
    expected_frequency: weekly
    notes: "Weekly AI research and policy newsletter. Median 7, longest 14 days between posts in the feed's 20 items"

  - id: cais_aisn
    name: CAIS AI Safety Newsletter
    description: "The AI Safety Newsletter from the Center for AI Safety, on AI safety research and policy."
    standing: specialist
    type: rss
    region: global
    category: analysis
    beat: ai
    class: feed
    priority: 4
    lane: normal
    enabled: true
    url: https://newsletter.safe.ai/feed
    parser: rss
    expected_frequency: monthly
    notes: "Center for AI Safety. Median 15, longest 47 days between posts in the feed's 20 items"

  - id: eu_digital_strategy
    name: European Commission Digital Strategy
    description: "News from the European Commission on digital policy, including the EU AI Act."
    standing: authoritative
    type: rss
    region: global
    category: advisory
    beat: ai
    class: feed
    priority: 4
    lane: normal
    enabled: true
    url: https://digital-strategy.ec.europa.eu/en/rss.xml
    parser: rss
    expected_frequency: weekly
    notes: "EU AI Act and wider digital policy; triage moves non-AI items off the AI beat. Median 7, longest 11 days between posts in the feed's 10 items"

  # DEEP Lane: long-form research. DEEP is a Paperclip routine with no worker schedule
  # (worker/scheduler.py), so a source here is read only when that routine runs.
  - id: arxiv_cs_cr
    name: arXiv Computer Science - Cryptography and Security
    description: "New academic preprints in cryptography and security posted to arXiv; preprints are not peer reviewed."
    standing: specialist
    type: rss
    region: global
    category: research
    class: feed
    priority: 4
    lane: deep
    enabled: true
    url: https://rss.arxiv.org/rss/cs.CR
    parser: rss
    expected_frequency: daily
    notes: Academic preprints

  # Additional specialist security sources
  - id: fortinet_blog
    name: Fortinet Security Blog
    description: "Threat research from FortiGuard Labs, published on the blog of the security vendor Fortinet."
    standing: specialist
    type: rss
    region: global
    category: vendor_advisory
    class: feed
    priority: 3
    lane: normal
    enabled: true
    url: https://feeds.fortinet.com/fortinet/blog/threat-research
    parser: rss
    expected_frequency: weekly
    # Was daily, so a quiet week demoted it to degraded. Measured 2026-10-31: median 10 days between posts, up to 21 (Jun 26 - Oct 8 2026).
    # /blog/feed 404s; this is the FortiGuard Labs threat-research feed behind the same blog.
    # Their PSIRT advisories are a separate feed worth adding on its own entry rather than
    # here: https://filestore.fortinet.com/fortiguard/rss/ir.xml (50 items, IR advisories).
    notes: Was /blog/feed, which 404s; now the FortiGuard Labs threat-research feed.

  - id: sophos_labs
    name: Sophos Labs
    description: "Sophos News: threat research and security news from the security vendor Sophos."
    standing: specialist
    type: rss
    region: global
    category: research
    class: feed
    priority: 3
    lane: normal
    enabled: false
    url: https://news.sophos.com/feed/
    parser: rss
    expected_frequency: daily
    # Disabled 2026-10-31: news.sophos.com now redirects to www.sophos.com/en-gb/blog/feed,
    # whose newest item is 2026-09-15, and the host still stalls requests per IP (timeouts
    # from the VM and from a second network). Re-enable with a feed that has current posts.
    # Until then it was left enabled deliberately. Measured 2026-10-01: this host answers 200 for a few requests
    # and then stalls every request from the same IP until the read timeout, regardless of
    # User-Agent — nine different strings, including ones that had just worked, all timed out
    # together. So it is per-IP rate or reputation mitigation, not something a header fixes;
    # testing it hard is what triggers it. At one request per 4 hours it may never fire. If it
    # does, source health will mark it degraded from real run data, which is the honest answer.
    notes: "Disabled: the feed moved to sophos.com and has had no new post since 15 Sep 2026; the host also stalls requests by IP."

  - id: zerodayinitiative
    name: Zero Day Initiative
    description: "The blog of Trend Micro's Zero Day Initiative, a vulnerability disclosure programme, on vulnerability research and monthly patch reviews."
    standing: specialist
    type: rss
    region: global
    category: research
    class: feed
    priority: 3
    lane: normal
    enabled: true
    url: https://www.zerodayinitiative.com/blog/rss.xml
    parser: rss
    expected_frequency: daily
    notes: null

  - id: cvedetails
    name: CVE Details Security News
    description: "CVE Details, a site that aggregates vulnerability records from public sources."
    standing: community
    type: rss
    region: global
    category: advisory
    class: feed
    priority: 2
    lane: fast
    enabled: false
    url: https://www.cvedetails.com/rss/cvedetails.rss
    parser: rss
    expected_frequency: hourly
    # Disabled 2026-10-01, not retired: the feed is behind a Cloudflare interstitial
    # (403 with cf-mitigated: challenge) that only a browser executing the challenge
    # script can clear, which is impersonation we are not doing. Left enabled it would
    # spend 96 failing requests a day and sit permanently red in source health for a
    # reason no amount of retrying fixes. Nothing is lost: CVE enrichment comes from
    # NVD and KEV status from cisa_kev, both of which are in this registry and work.
    notes: CVE update feed; disabled while behind a Cloudflare challenge.

  # Sources with no feed (Stage 3): a listing page read by a named parser
  # (worker/collectors/web_page.py), or a vendor API (worker/collectors/json_api.py).
  - id: asd
    name: ASD (Australian Signals Directorate)
    description: "News releases from the Australian Signals Directorate, Australia's signals intelligence and cyber security agency."
    standing: authoritative
    publisher: asd
    type: web_page
    region: au
    category: advisory
    class: web_page
    priority: 1
    lane: normal
    enabled: true
    url: https://www.asd.gov.au/news
    parser: asd_news
    expected_frequency: quarterly
    notes: "ASD's own news (cyber.gov.au is ACSC's). No feed; the listing page is read (worker/collectors/web_page.py). Months between posts: 231 days in 2025"

  - id: oaic
    name: Office of the Australian Information Commissioner
    description: "Media releases from the Office of the Australian Information Commissioner, the regulator for privacy and notifiable data breaches."
    standing: authoritative
    type: web_page
    region: au
    category: advisory
    class: web_page
    priority: 2
    lane: normal
    enabled: true
    url: https://www.oaic.gov.au/news/media-centre
    parser: oaic_media
    expected_frequency: monthly
    notes: "No feed; the media centre listing is read (worker/collectors/web_page.py). Up to 49 days between releases in Jun-Sep 2026"

  - id: msrc_cvrf
    name: Microsoft Security Updates
    description: "Microsoft's monthly security update releases from the Microsoft Security Response Center, listing the vulnerabilities each one fixes."
    standing: authoritative
    publisher: microsoft
    type: json_api
    region: global
    category: vendor_advisory
    class: feed
    priority: 2
    lane: normal
    enabled: true
    url: https://api.msrc.microsoft.com/cvrf/v3.0/updates
    parser: msrc_cvrf
    expected_frequency: monthly
    notes: "Microsoft's monthly security releases, newest 12. Up to 35 days between releases since 2024"

  - id: anthropic_news
    name: Anthropic News
    description: "Anthropic's own news: model releases, research and policy announcements."
    standing: specialist
    type: web_page
    region: global
    category: ai_security
    beat: ai
    class: web_page
    priority: 4
    lane: normal
    enabled: true
    url: https://www.anthropic.com/news
    parser: anthropic_news
    expected_frequency: weekly
    notes: "No feed; the listing page is read (worker/collectors/web_page.py), in its tile and list layouts since 2026-10. Up to 9 days between posts in Aug-Sep 2026"

  # Disabled sources with reasons
  - id: securityweek
    name: SecurityWeek
    description: "SecurityWeek, a cyber security news site covering threats, vulnerabilities and the security industry."
    standing: established
    type: rss
    region: global
    category: news
    class: feed
    priority: 3
    lane: normal
    enabled: false
    url: https://www.securityweek.com/feed/
    parser: rss
    expected_frequency: daily
    notes: "Blocked: Cloudflare 403 error on feed endpoint"

  - id: x_security_search
    name: X Security Search
    description: "Posts on X (formerly Twitter) matching a cyber security search."
    standing: community
    type: rss
    region: global
    category: social
    class: feed
    priority: 5
    lane: deep
    enabled: false
    url: https://x.com/search?q=cybersecurity
    parser: twitter_search
    expected_frequency: real_time
    notes: "Blocked: Requires cost-gated API access"

  - id: msrc_blog
    name: Microsoft Security Response Center Blog
    description: "The Microsoft Security Response Center blog on Microsoft's security updates and vulnerability response."
    standing: authoritative
    publisher: microsoft
    type: web_page
    region: global
    category: vendor_advisory
    class: web_page
    priority: 3
    lane: normal
    enabled: false
    url: https://msrc.microsoft.com/blog/
    parser: web_page
    expected_frequency: daily
    notes: "Rendered by script, so the page holds no posts, and its feeds return 403. Microsoft's security releases come from msrc_cvrf instead"

  - id: acsc_threats
    name: ACSC Threats
    description: "The Australian Cyber Security Centre's threats feed."
    standing: authoritative
    publisher: asd
    type: rss
    region: au
    category: advisory
    class: feed
    priority: 1
    lane: fast
    enabled: false
    url: https://www.cyber.gov.au/rss/threats
    parser: rss
    expected_frequency: hourly
    notes: "Feed endpoint exists but is empty"

  - id: acsc_advice
    name: ACSC Advice
    description: "General security advice for individuals and organisations from the Australian Cyber Security Centre."
    standing: authoritative
    publisher: asd
    type: rss
    region: au
    category: advisory
    class: feed
    priority: 1
    lane: fast
    enabled: false
    url: https://www.cyber.gov.au/rss/advice
    parser: rss
    expected_frequency: daily
    notes: "Evergreen content, migration-dated (Stage 3 differential sync)"