Inside our leak news feed: who we watch, what we send, and why every warning is signed

Published 2026-11-08

When a service you keep keys in is breached, the useful warning is the one that arrives the same day, says which keys to replace, and is right. That is what our leak news feed is for. It sends signed advisories to KeyRotate and FrontierStack, and publishes the same ones on Leak news. This post explains where those warnings come from, what we leave out, and what changed this month.

Nearly 50 sources, in three languages

Enfour's crawler, Security Watch, reads its sources every half hour. Until now they were mostly English and Japanese security news. It now also reads the national computer emergency response teams of four regions: CISA in the United States, CERT-EU and ENISA's EU Vulnerability Database, JPCERT/CC, IPA and JVN in Japan, and KrCERT/CC and KISA in Korea. Alongside them are the lists of vulnerabilities known to be exploited, the security announcements of PHP, Node.js and PostgreSQL, and the security press in all three languages: from BleepingComputer and The Record to piyolog, ITmedia and Security NEXT, and Boan News, DailySecu and Electronic Times. The full, current list is in What the leak news feed watches.

Only what reaches our users

Most security news is not for you. A shop's customer database leaking, a flaw in a hospital system, a statistics report: these matter to someone, but not to a person managing API keys or a set of servers. So Security Watch keeps a story only when it can reach people who use our apps:

• a breach, leak or forced reset at one of the services KeyRotate keeps keys for;
• a security release of server software FrontierStack checks on your servers, such as PHP, OpenSSH or nginx;
• an exploited flaw in a firewall, VPN gateway or load balancer FrontierStack monitors, such as NetScaler, FortiGate or PAN-OS;
• a compromised certificate authority, or poisoned packages, extensions and updates.

On a day's worth of Korean and Japanese news, that rule kept about one story in forty, and the ones it kept were the incidents we had in fact warned about.

Three kinds of advisories

Leak advisories go to KeyRotate and FrontierStack. KeyRotate asks whether you used the service, and where API keys were exposed it can replace the ones you saved there in one pass. Patch advisories go to FrontierStack's Security Updates pane, which compares the fixed versions with what each of your servers runs. New this month, edge appliance advisories go to the Edge Appliances pane. They add newly exploited flaws to the vendor tables built into the app, between releases. They can only add a vulnerability to those tables, never remove or relax one, so a mistake can't tell you a vulnerable appliance is safe.

Written in the language of the original notice

Advisories come in English, Japanese and Korean. When the original notice is Japanese or Korean, from a Japanese provider or KISA for example, that language's advisory follows the original's own wording: its names for menus and settings, its dates and its instructions. The other two languages are translations of it, so nothing is lost by translating back and forth.

A person signs every warning

Security Watch drafts. It never publishes. Every draft is read by a person at Enfour, checked against the company's own notice, and signed offline with a key that never leaves the signing Mac. The apps and the Leak news page check that signature before they show anything, so a warning can't be forged, even by someone who took over the server that hosts it.

The most serious ones, on social media too

When a leak is rated the most serious kind, meaning keys or logins were or may have been taken, and it reaches Mac users, we also post a short warning on Enfour's Facebook page with a link to the full advisory. The post goes out only once the signed advisory is live.

Where to read it

In KeyRotate and FrontierStack, advisories arrive on their own, at least twice a day. On the web, Leak news shows the current ones and the archive keeps every past one.