docs / security/threat-feed
Threat feed
How new rules enter the bundle.
Sources
NVD pipeline (nightly), crowd-sourced payload hashes (real-time), and manual additions from Flux8Labs research.
Pipeline
Every candidate is reviewed by a Flux8Labs engineer before promotion to the live bundle. The review process checks for false-positive rate, coverage breadth, and performance impact.
Signing and distribution
Approved candidates are signed with Ed25519 and pushed to every proxy within 60 seconds of promotion. The proxy verifies the signature on every fetch.