Detection Ledger

Show all entries including demos

Commit lag and historical OSV index are independent counts. A 24h-verifiable row can still be indexed from historical OSV.

Full commit history and JSON artifacts: github.com/attestd-io/detection-ledger

ledger_commit_at is within 24 hours of attestd_detected_at. That 24h window is a publication lag bound. It does not mean GitHub commit time equals detection time. Detection time is first_seen / attestd_detected_at. The GitHub commit publishes an already-recorded detection.

Showing 100 of 21763. Show all in this section · Full ledger.json

ledger_commit_at is missing or more than 24 hours after attestd_detected_at. Same incident class as the 24h-verifiable rows. Detection time is still first_seen / attestd_detected_at, not commit time.

Showing 100 of 15189. Show all in this section · Full ledger.json

How entries are defined

Registered is attestd_detected_at: the earliest first_seen, when the API began returning compromised: true. It is not GitHub commit time. 24h-verifiable means the ledger commit landed within 24 hours of that registration. Public git history confirms the lag bound. It does not make commit time equal detection time.

historical OSV index is a per-row label, not a separate incident class. It applies when source_published_at, or the OSV published date if that field is absent, is 30 days or more before attestd_detected_at. It is independent of whether ledger_commit_at landed within 24 hours.

OSV is a citation to the linked advisory when Attestd has one. Most live entries are registered from the OSV ingestion pipeline. An OSV link means Attestd indexed that advisory; it is not a claim that Attestd published first.

Citation is the primary advisory URL, a press URL when recorded, or the OSV page.

Detection source discloses how the incident entered Attestd. osv is the OSV MAL pipeline. registry is curated registry YAML. npm_deprecation and pypi_yank are registry-native security signals. news_monitor and agent are corroborated news or agent promotions.

Commits are public on GitHub. Manual historical sync may use GPG signing when configured. Live auto-push uses the GitHub Git Data API so incident files and ledger.json update together. Verify history with git log in the repository.