Rebrand to PoC Index and move to pocindex.io

The site called itself three different things: CVE PoC Hub in the title, CVE Radar in the h1 and the social metadata, and cve on GitHub. Google had no consistent site name to settle on, so none of the mentions compounded. CVE Radar was taken anyway, by SOCRadar's free tool and by cveradar.com. Every user-facing name and URL now comes from scripts/brand.py, so the next move is one edit rather than a sweep through the tree. Also repairs the parts of the site a crawler could not use: - robots.txt and sitemap.xml were both 404. scripts/build_seo.py writes them, wired into the Pages job. trending_poc.json, kev.json and stats.json stay crawlable because the first paint needs them; the five bulk payloads are disallowed, which is 13.2 MB per crawl spent on data no crawler queries. - Search state lives in ?q= now. Results were unlinkable, so nobody could cite one and there was no route for a SearchAction to declare. replaceState rather than pushState, so typing does not bury the back button. - A WebSite JSON-LD block carries the name Google prints as the site name. - The footer carries the MITRE trademark notice.
2026-10-27 16:51:03 +00:00 · 2026-09-02 03:36:22 +02:00
1 parent e58a5a26cc
commit 31da22381c
@@ -1 +1 @@
-cve.codepwn.win
+pocindex.io
@@ -1,5 +1,5 @@
 <svg xmlns="http://www.w3.org/2000/svg" width="1200" height="180" viewBox="0 0 1200 180"
-     role="img" aria-label="CVE Radar, 82,409 CVEs with public proof-of-concept exploits">
+     role="img" aria-label="PoC Index, 82,409 CVEs with public proof-of-concept exploits">
  <clipPath id="card"><rect x="1" y="1" width="1198" height="178" rx="12"/></clipPath>
  <rect x="0.5" y="0.5" width="1199" height="179" rx="12" fill="#0d1117" stroke="#30363d"/>
  <g clip-path="url(#card)" opacity="0.6"><g>
@@ -13,10 +13,10 @@
  </g></g>

  <text x="56" y="70" font-family="ui-monospace,SFMono-Regular,Menlo,Consolas,monospace" font-size="44" font-weight="700"
-        fill="#e6edf3" letter-spacing="2">CVE RADAR</text>
+        fill="#e6edf3" letter-spacing="2">PoC Index</text>
  <text x="56" y="104" font-family="ui-monospace,SFMono-Regular,Menlo,Consolas,monospace" font-size="15" fill="#8b949e">
    Public proof-of-concept exploits, indexed by CVE.</text>
-  <text x="56" y="132" font-family="ui-monospace,SFMono-Regular,Menlo,Consolas,monospace" font-size="15" fill="#2f81f7">cve.codepwn.win</text>
+  <text x="56" y="132" font-family="ui-monospace,SFMono-Regular,Menlo,Consolas,monospace" font-size="15" fill="#2f81f7">pocindex.io</text>

  <text x="620" y="96" font-family="ui-monospace,SFMono-Regular,Menlo,Consolas,monospace" font-size="34" font-weight="700"
        fill="#e6edf3" letter-spacing="-0.5">170,946</text>
@@ -3,22 +3,46 @@
 <head>
  <meta charset="UTF-8" />
  <meta name="viewport" content="width=device-width, initial-scale=1.0" />
-  <title>CVE PoC Hub</title>
-  <meta name="description" content="Search publicly available proof-of-concept exploits by CVE, vendor or product." />
+  <!-- Absolute URLs all point at the canonical host. Keep them in step with
+       SITE in scripts/brand.py, which drives every generated surface. -->
+  <title>PoC Index: Search CVE Proof-of-Concept Exploits</title>
+  <meta name="description" content="Search 82,000+ public CVE proof-of-concept exploits from GitHub, Nuclei, ExploitDB, Metasploit and Vulhub. Updated hourly. Free JSON API, no signup." />
+  <meta name="robots" content="index, follow, max-image-preview:large" />
  <link rel="icon" href="/favicon.ico" />
-  <link rel="canonical" href="https://cve.codepwn.win/" />
+  <link rel="canonical" href="https://pocindex.io/" />
  <meta property="og:type" content="website" />
-  <meta property="og:site_name" content="CVE Radar" />
-  <meta property="og:title" content="CVE Radar" />
+  <meta property="og:site_name" content="PoC Index" />
+  <meta property="og:title" content="PoC Index: Search CVE Proof-of-Concept Exploits" />
  <meta property="og:description" content="Public proof-of-concept exploits, indexed by CVE. Searchable, refreshed hourly, no signup." />
-  <meta property="og:url" content="https://cve.codepwn.win/" />
-  <meta property="og:image" content="https://cve.codepwn.win/social-card.png" />
+  <meta property="og:url" content="https://pocindex.io/" />
+  <meta property="og:image" content="https://pocindex.io/social-card.png" />
  <meta property="og:image:width" content="1280" />
  <meta property="og:image:height" content="640" />
  <meta name="twitter:card" content="summary_large_image" />
-  <meta name="twitter:title" content="CVE Radar" />
+  <meta name="twitter:title" content="PoC Index: Search CVE Proof-of-Concept Exploits" />
  <meta name="twitter:description" content="Public proof-of-concept exploits, indexed by CVE. Searchable, refreshed hourly, no signup." />
-  <meta name="twitter:image" content="https://cve.codepwn.win/social-card.png" />
+  <meta name="twitter:image" content="https://pocindex.io/social-card.png" />
+  <!-- WebSite.name is how Google decides what to print as the site name in a
+       result. Without it the title, the og tags and the h1 were three different
+       names and it picked one on its own. SearchAction points at the ?q= route
+       logic.js now keeps in the URL. -->
+  <script type="application/ld+json">
+  {
+    "@context": "https://schema.org",
+    "@type": "WebSite",
+    "name": "PoC Index",
+    "url": "https://pocindex.io/",
+    "description": "Search 82,000+ public CVE proof-of-concept exploits from GitHub, Nuclei, ExploitDB, Metasploit and Vulhub. Updated hourly. Free JSON API, no signup.",
+    "potentialAction": {
+      "@type": "SearchAction",
+      "target": {
+        "@type": "EntryPoint",
+        "urlTemplate": "https://pocindex.io/?q={search_term_string}"
+      },
+      "query-input": "required name=search_term_string"
+    }
+  }
+  </script>
  <link rel="preconnect" href="https://fonts.googleapis.com" />
  <link rel="preconnect" href="https://fonts.gstatic.com" crossorigin />
  <link href="https://fonts.googleapis.com/css2?family=Space+Grotesk:wght@400;500;600&family=IBM+Plex+Mono:wght@400;500&display=swap" rel="stylesheet" />
@@ -35,7 +59,7 @@
        <line class="hero-sweep" x1="200" y1="200" x2="200" y2="0" />
      </svg>
      <div class="hero-id">
-        <h1>CVE RADAR</h1>
+        <h1>PoC Index</h1>
        <p>Public proof-of-concept exploits, indexed by CVE.</p>
      </div>
      <dl class="hero-stats">
@@ -108,6 +132,9 @@
      <span>sources: nvd &middot; cve program &middot; github &middot; github advisories &middot; cisa vulnrichment &middot; cisa kev &middot; first epss</span>
      <span data-refreshed></span>
    </div>
+    <div class="container site-legal">
+      <span>CVE is a trademark of The MITRE Corporation. PoC Index is not affiliated with or endorsed by MITRE or the CVE Program.</span>
+    </div>
  </footer>

  <script src="/logic.js"></script>
@@ -702,7 +702,38 @@ function idleStatus() {
  return '';
 }

+/* ---- url state --------------------------------------------------------- */
+
+// A result was unlinkable: every search lived in memory, so nobody could cite
+// one and no crawler ever saw a second page. The query rides in ?q= now, which
+// is also the route the SearchAction in index.html declares.
+function readURLState() {
+  const params = new URLSearchParams(location.search);
+  const query = (params.get('q') || '').trim();
+  if (query) {
+    state.query = query;
+    el.input.value = query;
+  }
+  if (params.get('kev') === '1') state.kevOnly = true;
+}
+
+// replaceState, not pushState: typing a query should not bury the back button
+// under one history entry per keystroke.
+let urlTimer = null;
+function syncURL() {
+  clearTimeout(urlTimer);
+  urlTimer = setTimeout(() => {
+    const params = new URLSearchParams();
+    if (state.query.length >= MIN_QUERY) params.set('q', state.query);
+    if (state.kevOnly) params.set('kev', '1');
+    const search = params.toString();
+    const next = search ? `${location.pathname}?${search}` : location.pathname;
+    if (next !== location.pathname + location.search) history.replaceState(null, '', next);
+  }, 300);
+}
+
 function render() {
+  syncURL();
  if (state.query.length < MIN_QUERY && !hasActiveFilters()) {
    el.status.textContent = state.ready ? idleStatus() : 'loading index…';
    renderTrending();
@@ -914,6 +945,8 @@ async function loadJSON(url, options) {
  } catch (err) {
    console.warn(err.message);
  }
+  readURLState();
+  syncFilterControls();
  paintHeroStats();
  render();

@@ -1,5 +1,5 @@
 <svg xmlns="http://www.w3.org/2000/svg" width="1200" height="92" viewBox="0 0 1200 92"
-     role="img" aria-label="Search CVE Radar">
+     role="img" aria-label="Search PoC Index">
  <rect x="0.75" y="0.75" width="1198.5" height="90.5" rx="10" fill="#161b22"
        stroke="#2f81f7" stroke-width="1.5"/>
  <g fill="none" stroke="#8b949e" stroke-width="2.5" stroke-linecap="round">
@@ -1,5 +1,5 @@
 <svg xmlns="http://www.w3.org/2000/svg" width="1280" height="640" viewBox="0 0 1280 640"
-     role="img" aria-label="CVE Radar">
+     role="img" aria-label="PoC Index">
  <clipPath id="card"><rect x="56" y="56" width="1168" height="528" rx="16"/></clipPath>
  <rect width="1280" height="640" fill="#0d1117"/>
  <g clip-path="url(#card)" opacity="0.6"><g>
@@ -14,7 +14,7 @@
  <rect x="56" y="56" width="1168" height="528" rx="16" fill="none" stroke="#30363d"/>

  <text x="96" y="215" font-family="ui-monospace,SFMono-Regular,Menlo,Consolas,monospace" font-size="76" font-weight="700"
-        fill="#e6edf3" letter-spacing="3">CVE RADAR</text>
+        fill="#e6edf3" letter-spacing="3">PoC Index</text>
  <text x="96" y="272" font-family="ui-monospace,SFMono-Regular,Menlo,Consolas,monospace" font-size="24" fill="#8b949e">
    Public proof-of-concept exploits, indexed by CVE.</text>

@@ -31,5 +31,5 @@
        fill="#6e7681" letter-spacing="1.6">KNOWN EXPLOITED</text>

  <text x="96" y="532" font-family="ui-monospace,SFMono-Regular,Menlo,Consolas,monospace" font-size="22" fill="#2f81f7"
-        letter-spacing="1">cve.codepwn.win</text>
+        letter-spacing="1">pocindex.io</text>
 </svg>
@@ -1,4 +1,4 @@
-/* CVE PoC Hub. GitHub Primer dark_default tokens, per the refit handoff. */
+/* PoC Index. GitHub Primer dark_default tokens, per the refit handoff. */
 :root {
  --canvas: #0d1117;
  --canvas-subtle: #161b22;
@@ -520,7 +520,9 @@ a.chip:hover { color: var(--fg); border-color: var(--fg-muted); }
  font: 400 11px/1.6 var(--mono);
  color: var(--fg-muted);
 }
-.site-footer span:last-child { margin-left: auto; }
+.site-footer .container:first-child span:last-child { margin-left: auto; }
+.site-legal { padding-top: 8px; }
+.site-legal span { margin-left: 0; opacity: .72; }

 /* ---- narrow viewports --------------------------------------------------- */