The first full pass over all 60,039 reference URLs: 1,566 answer 404 or
410, which removes 2,663 links from 2,419 entries and 2,445 lines from
references.txt. Anything that timed out, refused a HEAD or answered 403
kept its link.
The weekly job takes it from here on a five-week cycle, so this only had to
be paid once.
Thirty of thirty sampled returned 404: the service is gone, so all 942
links across 911 entries are permanently dead. 576 entries held nothing
else and drop out of the search index rather than offering a reader a
guaranteed miss.
The corpus was assembled by a workflow that, in its own words, output every
search result without trying to filter them. Re-checking every link whose
repository does not name its CVE against the current classifier found
27,026 of 32,675 failing it: Shodan cheat sheets under Heartbleed, FTC
robotics team repositories under the jQuery prototype pollution CVE, Docker
images matched through their dependency manifests, and a repository called
"test".
16,613 links whose repository names the CVE were never examined, a
repository that could not be fetched kept all of its links, and one that
calls itself a PoC and names the CVE is kept even where the classifier
says otherwise — deleting a real PoC costs more than leaving a doubtful
one in place.
7,223 entries lighter, and repo_meta.json drops to the 26,755
repositories still referenced.
The audit found 8,404 of the 47,210 linked repositories gone from GitHub,
so 10,065 links across 5,495 entries pointed at 404s. 1,940 entries held
nothing but dead links and now carry no PoCs at all, which drops them from
the search index rather than offering a reader broken results.
The 4,733 entries whose advisory lists no affected version still rendered
an empty shields.io chip; they now read n/a like the product and
vulnerability badges beside them.
0xMarcio