How to cite this record

Citing a source held in the record

This is the normal case, and the reason to involve this archive at all is usually that the page has since changed or gone. Give the original publication, then the state and where it is preserved:

Coinkite. "Mk3 security advisory." 30 July 2026.
  https://blog.coinkite.com/coldcard-mk3-seed-generation-warning/
  State of 1 August 2026, 00:17:31 UTC preserved at
  https://cc-vuln.org/record/sources/coinkite-mk3-advisory/

Every registered source has a page of that shape at /record/sources/, listing each state held, when it was observed, and what changed between one state and the next. Quote the capture time when the wording matters, which for a live incident it usually does: that advisory said three materially different things in thirty hours, and a citation without a time does not say which one you read.

Some held states were not collected by this project. The two earliest states of that advisory were recovered from the Internet Archive after the fact, and are marked provenance: wayback wherever they appear. Cite those to the Wayback Machine, which collected them, rather than to this project, which inherited them. The source page says which is which for every state it holds.

Citing the project itself

Appropriate when you are citing the collection, the change record, or a figure it derived rather than one it reports.

cc-vuln.org. COLDCARD predictable-RNG incident archive. 2026.
  https://cc-vuln.org/ (commit 0e17c99e366f, accessed 15 Aug 2026)

The author is the project, not a person: the site is published pseudonymously, and attribution to "cc-vuln.org" is both what the licence asks for and all there is.

@misc{cc-vuln-coldcard-2026,
  author       = {{cc-vuln.org}},
  title        = {{COLDCARD} predictable-{RNG} incident archive},
  year         = {2026},
  howpublished = {\url{https://cc-vuln.org/}},
  note         = {Commit 0e17c99e366f, accessed 15 Aug 2026}
}

{
  "id": "cc-vuln-coldcard-2026",
  "type": "dataset",
  "title": "COLDCARD predictable-RNG incident archive",
  "author": [{ "literal": "cc-vuln.org" }],
  "publisher": "cc-vuln.org",
  "issued": { "date-parts": [[2026]] },
  "URL": "https://cc-vuln.org/",
  "accessed": { "date-parts": [[2026, 8, 15]] },
  "note": "commit 0e17c99e366f"
}

A repository citation, including for the capture tooling, is in CITATION.cff, which GitHub renders as a "Cite this repository" button.

Naming the state you read

This record changes: sources are polled on a schedule, new material is registered, and pages are corrected. An "accessed" date alone therefore points at nothing recoverable. Every build stamps the commit it was made from, in the page footer and at /version.json, along with how much of the record existed at that commit. Quote that commit and the state you read can be reconstructed exactly from the public repository.

There is no DOI. Citing the URL together with the commit identifies the state precisely, which a DOI on a moving record would not; if that changes it will be published here and in CITATION.cff.

What citing this record does and does not assert

What is stable

Citations are made to last, so these are commitments rather than current behaviour:

• Source identifiers are permanent and never reused. coinkite-mk3-advisory means one source for good, so /record/sources/coinkite-mk3-advisory/ is safe to cite.
• Retired routes redirect permanently rather than disappearing. Pages have been merged and rebuilt already; every published URL still resolves, and that is a build gate rather than an intention.
• Snapshots are append-only, from 6 August 2026. A snapshot is not rewritten or deleted, including one this project later decides was wrong: a bad capture is corrected by a later capture or a classification beside it, never by editing the record. Redacting personal data this project itself leaked is the one standing exception. The rule is dated because the archive has not always met it: a capture-method migration on 4 August 2026 deleted the earlier captures of five Reddit sources, and two sets of duplicate media from the first days of collection were removed on 6 August. Both are recorded, the first in corrections and both in the repository changelog with file sizes and hashes. Everything held now, and everything captured since, is covered by the rule as stated.
• The register is published as data. /record/sources.json against a versioned JSON Schema, with the change record at /record/changes.json. Machine consumers should read those rather than scraping the pages.

Announcements on nostr

The project announces record updates on nostr as npub1pfuvza2kkeqjqnp6l2tlqr2ewgx5ue0kc7rwztxvjr8p5wcec3zsrvp9w2. The identifier [email protected] verifies that key against this domain, so a client can confirm the account is this project's and not an impersonator's. Announcements point at the record; they are not part of it, and nothing cited here depends on one.

Licence and attribution

The project's own writing, diagrams and data are CC BY 4.0: copy, mirror and adapt them, including commercially, with attribution to cc-vuln.org and a link. The capture tooling and the site code are MIT. Attribution is not only courtesy here: the claims are graded and linked to artefacts, and material stripped of its attribution and markers can no longer be rechecked, which turns a record into an assertion.

Material captured from other people is neither of those licences. It remains its authors' copyright, held for research and archival purposes and quoted with attribution. Reusing it is between you and them. Full terms are in LICENSE-CONTENT.md.

For journalists and researchers

The project is independent, pseudonymous, unfunded and not affiliated with any party in the record. It carries no advertising and sells nothing. Questions about method, requests for the reasoning behind a figure, and pointers to material the record is missing all go to [email protected].

The whole collection, the capture tooling, the review classifications and this site are public at the source repository. Anything asserted here can be re-derived from it, which is the point.