1,000,000 requests/month. Still $0 marketing. Wild.

I woke up to a graph that didn’t look real: CVEFeed.io just crossed one million HTTP requests this month. No ads, no launch campaign, not even a proper “marketing” page—people simply found it, wired it in, and kept it. I’m genuinely blown away. When I started this, it was a scrappy feed for my own workflow; now there are teams depending on it for real-time signal in their SOCs and CI pipelines.

The step-change came from shipping things that practitioners immediately feel. I added EPSS to help people see “how likely is this to be exploited soon?” at a glance, and I built a GitHub exploit crawler to surface PoCs and real exploit code tied to CVEs. Seeing an alert with severity, EPSS, and a live exploit reference turns a maybe into a must-fix. It tightened the loop from “heard about it” → “understood risk” → “took action.”

Here’s the unexpected part: the community is now asking for things that look a lot like a product roadmap—role-based access, higher API limits, guaranteed delivery, on-prem mirrors, SBOM import with auto-watchlists, ticket sync. To build and support those well, I’m seriously considering a subscription model: the core feed stays free (that’s a promise), while power features fund reliability and support for teams who need them. Think: generous Free, sensible Pro/Team, and an Enterprise path for higher number of alert!

I haven’t decided pricing yet—my north star is simple: don’t tax insight; charge for scale and guarantees.