webhooks are way more useful than email-only for this stuff. the local exploit hazard api sounds like the part i’d actually use day to day, since cve feeds get noisy fast without some kind of prioritization.