Transparency
Sources of truth
ChangeOtter only wires verified official vendor, status, and advisory primaries (RSS/XML/JSON/API). Discovery URLs marked verify-before-wire are never treated as primary ingest. Full HTTP audit: docs/verified-sources.md.
Cloud status probes
- AWS —
health.aws.amazon.com/public/currentevents+status.aws.amazon.com/rss/all.rss - Azure —
azurestatuscdn.azureedge.net/en-us/status/feed/(empty = healthy) - Google Cloud —
status.cloud.google.com/incidents.json - Microsoft 365 — Graph Service Health (Unknown without tenant credentials; never invented)
Microsoft Graph — Service Communications
api · breakingMust-have breaking. Prefer over HTML scrape. Official Graph endpoint; 401 without app token (stub OK).
graph.microsoft.com/v1.0/admin/serviceAnnouncement/messagesMicrosoft Graph — Service Health
status · breakingMust-have breaking (active incidents). Same Graph app as service messages. Stub until credentials.
graph.microsoft.com/v1.0/admin/serviceAnnouncement/healthOverviewsMicrosoft 365 Roadmap
rssRoutine digest. Public feature RSS (redirects to releasecommunications api/v2/m365/rss).
www.microsoft.com/en-us/microsoft-365/RoadmapFeatureRSSMicrosoft 365 Roadmap (v2)
apiPublic OData-style roadmap; good structured digest ingest.
www.microsoft.com/releasecommunications/api/v2/m365Azure Updates
rss · breakingMust-have for retirements/breaking. Preferred modern feed.
www.microsoft.com/releasecommunications/api/v2/azure/rssAzure Service Health status
status · breakingMust-have for breaking outages. Empty channel = healthy. Also used by StatusBanner.
azurestatuscdn.azureedge.net/en-us/status/feed/AWS What's New
rssRoutine digest. High volume — filter by client-relevant services.
aws.amazon.com/about-aws/whats-new/recent/feed/AWS Security Bulletins
rss · breakingMust-have breaking. Canonical page /security/security-bulletins/; feed path /rss/feed/ (not /rss/).
aws.amazon.com/security/security-bulletins/rss/feed/AWS Service Health status
status · breakingPublic status RSS (application/rss+xml). Pair with aws-health-currentevents for live banner.
status.aws.amazon.com/rss/all.rssAWS Health public currentevents
status · breakingOfficial public Health JSON (often UTF-16). Used by StatusBanner / cloudStatus.ts; empty array = no public events.
health.aws.amazon.com/public/currenteventsGoogle Cloud status incidents
status · breakingOfficial GCP status JSON. Used by StatusBanner / cloudStatus.ts.
status.cloud.google.com/incidents.jsonCISA Cybersecurity Advisories
rss · breakingMust-have breaking.
www.cisa.gov/cybersecurity-advisories/all.xmlCISA Known Exploited Vulnerabilities catalog
advisory · breakingMust-have. Drive patch-now urgency; JSON catalog is public.
www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.jsonVeeam security advisories
rss · breakingMust-have breaking. Verified Atom feed (application/xml). Live fetcher wired (severity + CVSS from KB body).
www.veeam.com/services/open/kb/security-feedConnectWise Security Bulletins
rss · breakingMust-have. Verified application/rss+xml (not the HTML bulletins page).
www.connectwise.com/company/trust/security-bulletins/rssMicrosoft SQL Server blog
rssProduct announcements and engine updates. Verified RSS.
www.microsoft.com/en-us/sql-server/blog/feed/SQL Server CU and GDR updates
rss · breakingMerges CU + GDR Learn search RSS; filter to CU/GDR/build version signals. Primary machine-readable for patch tracking. Pair with sqlserver-latest-updates-hub HTML SoT.
learn.microsoft.com/api/search/rss?search=%22cumulative%20update%22%20%22SQL%20Server%22&locale=en-usMSRC — SQL Server vulnerabilities
advisory · breakingCVRF: updates JSON → newest YYYY-Mon → cvrf/{ID} XML; extract Vulnerability blocks mentioning SQL Server. Also works as /cvrf/v3.0/Updates?api-version=2023-11-01 (same 200 JSON). CVE URL: https://msrc.microsoft.com/update-guide/vulnerability/{CVE}.
api.msrc.microsoft.com/cvrf/v3.0/updatesMSRC Update Guide
rss · breakingEmergency: verified application/rss+xml. Not product-filtered — fetcher filters /SQL\s*Server/i. Prefer alongside msrc-sql-advisories CVRF. Live fetcher wired.
api.msrc.microsoft.com/update-guide/rssSQL Server Tech Community
rss · breakingPRIMARY. Verified live RSS (Aurora /t5/s/ workaround; no confirmingRedirectReason). CU/GDR + Security Update posts. Live fetcher wired. Research: /workspace/changeotter-sql-server-sources.md.
techcommunity.microsoft.com/t5/s/gxcuf89792/rss/board?board.id=SQLServerSQL Server latest updates & version history
portal · breakingHTML SoT hub for builds/CU/GDR tables. Fetcher parses version tables (prefer over Download Center). Elevate when GDR or CU+GDR rows appear. aka.ms/SQLServerbuilds linked from page. Research: /workspace/changeotter-sql-server-sources.md.
learn.microsoft.com/en-us/troubleshoot/sql/releases/download-and-install-latest-updatesSQL Server 2025 release notes
blog · breakingHTML reference hub (Learn conceptual). URL fixed from dead ver16 path (404). Stub fetcher OK. Points to breaking changes / requirements.
learn.microsoft.com/en-us/sql/sql-server/sql-server-2025-release-notes?view=sql-server-ver17SQL Server 2025 breaking changes
blog · breakingHTML SoT for upgrade blockers (OLE DB/Encrypt, FTS, etc.). Learn conceptual docs; stub fetcher OK.
learn.microsoft.com/en-us/sql/database-engine/breaking-changes-to-database-engine-features-in-sql-server-2025?view=sql-server-ver17SQL Server discontinued Database Engine features
blog · breakingHTML SoT for removed features (DQS/MDS/etc in 2025). Learn conceptual; stub fetcher OK.
learn.microsoft.com/en-us/sql/database-engine/discontinued-database-engine-functionality-in-sql-server?view=sql-server-ver17SQL Server 2025 known issues
blog · breakingHTML SoT for upgrade blockers / known issues. Learn conceptual; stub fetcher OK.
learn.microsoft.com/en-us/sql/sql-server/sql-server-2025-known-issues?view=sql-server-ver17What's new in SQL Server 2025
blog · breakingHTML product-change hub (editions/discontinued callouts). Learn conceptual; stub fetcher OK.
learn.microsoft.com/en-us/sql/sql-server/what-s-new-in-sql-server-2025?view=sql-server-ver17What's new — Azure SQL Database
blog[Azure SQL-specific] Secondary planned for hybrid admins. Learn conceptual HTML; stub OK. Cadence daily; elevate deprecations.
learn.microsoft.com/en-us/azure/azure-sql/database/doc-changes-updates-release-notes-whats-new?view=azuresqlWhat's new — Azure SQL Managed Instance
blog[Azure SQL-specific] Secondary planned; update-policy / connectivity changes matter vs on-prem CU level. Learn conceptual; stub OK.
learn.microsoft.com/en-us/azure/azure-sql/managed-instance/doc-changes-updates-release-notes-whats-new?view=azuresqlWhat's new — SQL Server on Azure VMs
blog[Azure SQL-specific] Secondary planned for IaaS SQL. Learn conceptual; stub OK. Cadence daily; not emergency unless deprecation.
learn.microsoft.com/en-us/azure/azure-sql/virtual-machines/windows/doc-changes-updates-release-notes-whats-new?view=azuresqlAzure SQL What's new
rss[azure-sql-specific] Live Learn search RSS + path filter for Database / MI / SQL on Azure VMs What's new. vendorSlug azure so hybrid notes do not pollute on-prem SQL lane. Tags include azure-sql-specific.
learn.microsoft.com/api/search/rss?search=%22What%27s%20New%3F%20-%20Azure%20SQL%20Database%22&locale=en-usSQL Server breaking changes and known issues
rss · breakingLearn search RSS merge filtered to breaking-changes / discontinued / deprecated / known-issues. Complements HTML hub stubs. Research map §3.
learn.microsoft.com/api/search/rss?search=%22Database%20Engine%3A%20Breaking%20Changes%20-%20SQL%20Server%202025%22&locale=en-usFortiGuard PSIRT advisories
rss · breakingOfficial FortiGuard IR advisories RSS (text/xml, 50 items). CVSSv3 score in description; 'exploited in the wild' wording marks actively exploited.
www.fortiguard.com/rss/ir.xmlCisco PSIRT security advisories
rss · breakingOfficial Cisco PSIRT RSS (50 most recent). Security Impact Rating drives severity; Meraki advisories carry a meraki tag.
sec.cloudapps.cisco.com/security/center/psirtrss20/CiscoSecurityAdvisory.xmlKaseya / Datto status incidents
status · breakingOfficial Statuspage v2 JSON (history.rss also live). status.datto.com/history.rss 302-redirects to status.kaseya.com, so one source covers both; Datto incidents route to vendor datto.
status.kaseya.com/api/v2/incidents.jsonMicrosoft Defender What's New
rssLearn search RSS per Defender product (Endpoint, Office 365, Identity, Cloud Apps, XDR). Title-filtered to What's New / release-notes pages; informational only.
learn.microsoft.com/api/search/rss?search=%22What%27s%20new%20in%20Microsoft%20Defender%20for%20Endpoint%22&locale=en-usOkta security advisories
advisory · breakingOfficial RSS ('Subscribe to RSS Feed' on trust.okta.com/security-advisories/). CVSS read from each advisory's Gatsby page-data.json (newest 12 per run).
trust.okta.com/security-advisories.xmlOkta status incidents
status · breakingStatus RSS returns 401 anonymously. Page server-renders Incident__c JSON (data-id=incidents); Category__c maps to impact.
status.okta.com/CrowdStrike security advisories
advisory · breakingHTML only (no feed). Listing cards + detail pages for CVSS. No publish date on pages → publishedAt null. Blog excluded.
www.crowdstrike.com/en-us/security-advisories/SonicWall PSIRT advisories
api · breakingPublic JSON API used by the psirt.global.sonicwall.com/vuln-list SPA (also serves /api/v1/feed/rss.xml). Impact + CVSS structured.
psirtapi.global.sonicwall.com/api/v1/vulnsummary/?srch=Microsoft Intune What's New
blogOfficial Learn HTML. Weekly headings date each change. Informational.
learn.microsoft.com/en-us/intune/whats-new/Microsoft Entra What's New
blogOfficial Learn HTML. Month headings date each change; months older than 45 days are skipped. Informational.
learn.microsoft.com/en-us/entra/fundamentals/whats-newVMware vSphere 8.0 release notes
blog · breakingOfficial TechDocs. ESXi and vCenter update/patch release notes: date, build, CVEs, VMSA, patch severity.
techdocs.broadcom.com/us/en/vmware-cis/vsphere/vsphere/8-0/release-notes.htmlAcronis security advisories
advisory · breakingOfficial Atom feed (security advisories only; product-update entries skipped); the advisories JSON adds CVE, CVSS and severity.
security-advisory.acronis.com/feedCommvault security advisories
advisory · breakingOfficial advisory index; each surfaced advisory's detail page gives severity and CVSS.
documentation.commvault.com/securityadvisories/Microsoft Partner Center announcements
blogOfficial monthly Learn pages, filtered to licensing, pricing and billing changes. Informational.
learn.microsoft.com/en-us/partner-center/announcements/Microsoft 365 Blog (licensing)
rssOfficial Tech Community RSS, filtered to licensing, pricing and end-of-support posts. Informational.
techcommunity.microsoft.com/t5/s/gxcuf89792/rss/board?board.id=microsoft_365blogGoogle Workspace Updates (pricing & editions)
rssOfficial Atom feed, filtered to pricing, edition and SKU changes. Informational.
workspaceupdates.googleblog.com/feeds/posts/default?redirect=false