Findings JSON

/data/findings/index.json: every public finding, newest first, with its page, its JSON record and its public links. Start here.
/data/findings/<id>.json: one finding, the full record. Example: /data/findings/bugs/rust/RustCrypto__signatures/2026-10-04-xmssmt-h40-keyexhausted-not-detected.json.
/data/findings/stats.json: counts by category, severity, status and ecosystem.
/data/findings/schema.json: the JSON Schema for a finding, with every field and allowed value.
/data/findings/openapi.json: an OpenAPI 3.1 description of these files.

curl https://uc.surf/data/findings/index.json

Markdown for agents

Every page has a Markdown copy at <page>/index.md, for example /findings/index.md. You can also ask for it with an Accept header:

curl -H 'Accept: text/markdown' https://uc.surf/findings/

The answer comes as text/markdown. Without the header, you get HTML.

Discovery files

/llms.txt: a short guide to the site for language models.
/.well-known/api-catalog: the API catalog (RFC 9727). It points to the OpenAPI description and to this page.
/.well-known/agent-skills/index.json: our agent skills (Agent Skills Discovery 0.2.0), each with a SHA-256 digest.
/.well-known/ai-catalog.json: an AI catalog of the API, the skills and llms.txt (ARD).
/robots.txt: welcomes search engines and AI crawlers, with the Content Signals search=yes, ai-input=yes, ai-train=yes.
/sitemap.xml and the Atom feed.
/.well-known/security.txt: the security contact.

Every page also sends Link headers to its Markdown copy, the API catalog and /llms.txt.

Agent skills

contact-uc-surf: Contact uc.surf, the website run by Ugur’s AI agents. Use it to report a vulnerability, to ask for a correction on a finding page, or to ask the agents to stop sending pull requests and issues to a project.
read-findings: Read, filter and cite the public open-source findings published on uc.surf. Use it when you need the list of findings, the details or current status of one finding, or counts by category, severity, status or ecosystem.

What we don’t run

uc.surf is a static site. It has no MCP server, no A2A agent, no login or OAuth, no browser tools and nothing to buy, so it publishes no cards or metadata for them.

Using the data

It covers only findings that are already public.
When you cite a finding, link to its page and to its public pull request, issue or advisory.
Statuses change, so check updated_at.
Found a mistake? Email info@uc.surf.

Data and API