OpenThreat: what a security tool found in the open, as one file

Every security tool finds things, and every one keeps what it found behind its own login. A scanner that runs on a thousand public repositories knows which rules fire most and where, and says nothing, because saying it would mean a feed, a schema, an API key and a sales call. The threat feeds that do exist are products: a licence per seat, terms that forbid redistribution, and a format each vendor invented.

Today ThreatCrush starts publishing what it finds in the open, and LogicSRC publishes the file format it uses to do it.

OpenThreat

OpenThreat is one file a security tool serves about what it found in the open, at /.well-known/openthreat.json. A finding in a public repository, an attack observed against the reporter's own infrastructure, an indicator worth blocking, an advisory. Each threat carries the rule (the same string a SARIF ruleId carries), the severity, the CWE, the subject, the location, a status, and when it was first and last seen.

{
  "reporter": { "name": "ThreatCrush", "web": "https://threatcrush.com",
                "policy": "https://threatcrush.com/discovery#policy" },
  "threats": [
    { "kind": "finding", "title": "SQL assembled by concatenation", "severity": "high",
      "rule": "js-sql-string-building", "cwe": "CWE-89",
      "subject": { "name": "northwind/api", "url": "https://github.com/northwind/api" },
      "location": { "file": "src/db/users.ts", "line": 42 }, "status": "open" },
    { "kind": "finding", "title": "Hardcoded credential", "severity": "critical",
      "rule": "secret-generic-credential", "category": "secret",
      "subject": { "name": "northwind/api", "url": "https://github.com/northwind/api" },
      "status": "open" }
  ]
}

Twelve rules degrade the way every LogicSRC spec does: the smallest valid file is a reporter with a name and a threat with a title, and absence is unstated. Two rules do not degrade, and they are the reason the file can exist at all.

A subject is public or it is not in the file. A finding about a private repository, a customer's server, a paying user's scan, or anyone's infrastructure but the reporter's own is not a threat in the open. It is someone's private security posture, and publishing it is a breach. A reporter that scans private things keeps two tables and serves one.

A secret is never located while it is open. Look at the second threat above. It is a hardcoded credential in a public repository, and the file says the rule, the severity, the subject and the status, and nothing else. No file, no line, no excerpt. The credential is already exposed by being public; the file must not be the map to it.

threatcrush.com/discovery

ThreatCrush is the first reporter. Its GitHub App scans the repositories it is installed on, and from today the findings in the public ones are listed on the discovery page and served in the descriptor. Nothing from a private repository is ever there, and nothing about organisations, servers, properties or detections is either. Sensitive findings are redacted as the spec says, and the code refuses to serialise the file at all if a forbidden key ever reaches it.

Announcing is on by default, because a finding in a public repository is public already, and a list nobody is on lists nothing. The person who installed the app turns it off with one switch under their account. A repository that opts out leaves the file on the next build.

nichedb.dev/c/threats

nichedb.dev is the first directory. It reads any reporter's descriptor, verified by the origin it came from, and lists the threats as feeds: all of them, critical and high, findings, attacks, the open ones. RSS, JSON, an API and MCP over the same rows, like every other collection there.

Why a file and not a feed

STIX describes threat intelligence exhaustively and SARIF describes one scanner run. OpenThreat is the small file a tool can serve in an afternoon: the standing list across runs, with a subject and a status, and the disclosure rules the other two do not have. A directory that speaks STIX can translate. A defender who wants to know what is being found in the open this week, by tools that are not theirs, fetches a URL.

The spec is at logicsrc.com/docs/openthreat, CC BY 4.0. Serve one, copy it, extend it.