vulnvote

Dedupe. A vulnerability usually has several names. The lookup asks OSV for a record's aliases and stores them in your vote, and the board merges every vote whose ids link up, so a vote on a GHSA and a vote on its CVE land on one entry. Each voter counts once per vulnerability, whichever alias they used.

Weights. A vote counts age × vouches × calibration. Age: the voter's account age from the PLC directory, 0.1 for a brand-new account rising to 1 at a year, so a pile of fresh sock accounts barely registers. Vouches: other voters can vouch for someone; each distinct voucher adds their own age weight, with logarithmic returns. Calibration: how close a voter's 0–10 severity calls land to the median of everyone else's on the same vulnerabilities (needs a few comparisons; 0.5 to 1.25). Expand any entry to see each voter's breakdown.

Where the data lives. Votes are net.bisks.vulnvote.vote records and vouches are net.bisks.vulnvote.vouch records in the voter's own PDS. This page reads every one on the network (relay listReposByCollection, each PDS, then Jetstream) and computes the board in your browser; there is no server.

Not covered yet. Exploitability context (is it reachable in your stack?), per-ecosystem boards, and a vote-on-the-voters appeal path are all open questions. Ideas welcome.