Bulk analysis without a black box.

Choose the workflow that matches your plan

* Free includes five web-console lookups per week. The file cap counts non-empty data rows, including invalid and duplicate rows; quota is reserved only for unique valid CVE identifiers. The complete batch must fit the user's remaining weekly allowance. If it does not, the complete batch is rejected and no CVE is processed.

CSV creation across sync and async modes has a fair-use guardrail of 100 persisted upload attempts in any rolling 24-hour window. Free, Pro, and Enterprise are scoped per user; Team members share the allowance at the organization level. Idempotent retries of the same upload do not consume another slot, while completed, cancelled, failed, and quota-rejected attempts remain in the window.

To prevent repeated create-and-cancel cycles from generating unbounded work, a second, non-refundable rolling budget counts unique CVEs submitted to async jobs: 150,000 per Team organization and 200,000 per Enterprise seat. Quota-rejected, cancelled, and failed attempts continue to count against this creation budget. Exact idempotent retries do not consume this creation budget. Normal lookup-quota refund rules are unchanged.

CSV in, reviewable evidence out

1. Create a UTF-8 CSV with one CVE identifier per row. A cve_id header is optional.
2. Review the unique, duplicate, and invalid-row counts before submitting. A batch is never partially accepted merely to fit a plan or quota.
3. Free and Pro receive a result preview synchronously. Team and Enterprise can leave the page while the worker processes the job.
4. For asynchronous jobs, RealExploit sends a transactional email and an in-console notification when the result is ready or the job fails.
5. Download the result CSV within 30 days. The console shows the exact expiry time.

cve_id
CVE-2021-44228
CVE-2024-3094
CVE-2014-0160

Real use cases

API and job lifecycle

• POST /v1/bulk — synchronous JSON batch for Team and Enterprise.
• POST /v1/bulk/upload — CSV upload; synchronous or asynchronous according to plan.
• GET /v1/bulk/jobs and GET /v1/bulk/jobs/{id} — recent jobs, progress, preview, and expiry.
• GET /v1/bulk/jobs/{id}/download — authenticated result download. Not-ready jobs return a conflict and expired objects return gone.
• GET /v1/bulk/template — canonical one-column template.

API batches consume normal plan quota and return the normal rate-limit headers. Requests that exceed the plan limit, remaining quota, or async fair-use guardrail are rejected as a unit; there are no surprise overage charges.

Storage and retention

Uploads are parsed into normalized CVE identifiers in the application database; the original upload bytes and unsupported columns are not retained. Async working rows are deleted when the job completes, fails, or is cancelled, leaving at most ten preview rows with the job record. Only a completed asynchronous result CSV is stored under a non-derivable object key in a private Cloudflare R2 bucket. Downloads require an authenticated, authorized request, and signed redirects do not make the bucket public. Each link lasts no longer than five minutes and is capped by the time remaining before the 30-day download expiry. A link already issued before account or job access is revoked can remain usable only until that short TTL expires; no new link is issued. Lifecycle cleanup then schedules removal of any remaining object. Do not place asset names, customer names, hostnames, credentials, or other sensitive columns in the one-column upload.