Intelligence
Know how risky the world is before you let it in.
riskd aggregates free, commercially-usable threat feeds into a single normalized risk envelope — one call returns the matched signals, a weighted score, and a level you can put straight into a policy decision.
What it aggregates
One envelope instead of ten integrations.
Anonymizers, botnet command-and-control, drop lists, cloud ranges and disposable email — normalized, provenance-tracked, and merged into a single score so your policy layer never learns the shape of any individual feed.
Ingest pipeline, not an import
Every source carries a refresh TTL and provenance. A failed or empty fetch never wipes what you already have — a feed going dark upstream degrades the score, it doesn't blank the database.
The hot path never touches disk
Feeds persist to SQLite, but lookups hit merged, sorted interval arrays in memory — a binary search per source. Reputation is only useful if you can afford to ask on every request.
Scoring is configuration
Signal weights and thresholds live in a config file, not in code, so tuning for false positives is an edit rather than a release. Per-tenant overrides are the planned next step.
Metering doubles as audit
Per key, per day, per endpoint counts — the same rows that would bill a tenant are the ones that show an auditor who asked what, and when.
License hygiene, enforced
"Free to use" is not "free to resell". Only feeds cleared as commercially usable ship enabled; anything needing a license review ships switched off, in the config, where you can see it.
Passwords by k-anonymity
Breached-credential checks send a SHA-1 prefix, never a plaintext password and never a full hash, with results cached so the same answer isn't bought twice.
The interface
Six endpoints. One of them is the one you'll call.
Every /v1/* route takes an API key. The risk envelope is the primary call; the rest are enrichment, transparency and administration.
| Endpoint | What it returns |
|---|---|
| GET /v1/ip/{ip} | The risk envelope: which signals matched, a weighted score from 0–100, and a level of low / medium / high |
| GET /v1/email/{address} | Disposable-domain check — accepts a full address or just the domain |
| GET /v1/password/sha1/{sha1} | Breached-password check by k-anonymity. SHA-1 prefix only, never plaintext |
| GET /v1/sources | Feed status: last refresh, indicator counts, and the license flag for each source |
| GET /v1/usage | Your key's metered usage |
| GET /healthz | Liveness and loaded indicator count, unauthenticated |
Status: v1 is built and running — ten feeds live, roughly 32,000 raw indicators on a full pull, about 1,400 requests per second including the metering write. It is not yet a hosted product. The roadmap runs through per-tenant scoring, a GeoIP and ASN enrichment backbone, and self-generated honeypot telemetry — because aggregating public feeds makes you a competent aggregator anyone can replicate, and original data is the only durable moat.
Where it sits
Three products, one question each.
riskd is the intelligence leg. It has no opinion about your agents and never sees a credential — it answers one question, and the other two decide what to do about it.
Cipherlatch
Decides who may act. Scoped, short-lived credentials brokered per request; the agent never holds a standing key.
riskd
Says how risky the world is. One normalized envelope from many feeds, cheap enough to ask on every request.
Nightlatch
Watches what actually happened, and reacts — the question the other two can't answer.