From 03d3a519bd37d91b03c6b46bd51983890300d3fe Mon Sep 17 00:00:00 2001
From: "andre.bolinhas" <andre.bolinhas@articatech.com>
Date: Wed, 4 Nov 2026 14:58:38 +0000
Subject: [PATCH] Publish CVE channel (2026-11-04T14:58:23Z)

Validated against the engine's TestPublishedFeedDoesNotDuplicateACompiledRule guard.
Entries carrying an id: 3
---
 cve.json | 15 ++++++++++++++-
 1 file changed, 14 insertions(+), 1 deletion(-)

diff --git a/cve.json b/cve.json
index 4504cb6..c4ba8a1 100644
--- a/cve.json
+++ b/cve.json
@@ -1,5 +1,5 @@
 {
-  "build_datetime": "2026-11-04T01:02:01Z",
+  "build_datetime": "2026-11-04T14:58:23Z",
   "rulesets": [
     {
       "id": "edgeguard-cve",
@@ -27,6 +27,19 @@
             "https://raw.githubusercontent.com/projectdiscovery/nuclei-templates/main/http/cves/2017/CVE-2017-9841.yaml"
           ],
           "origin": "imported from the Nuclei template by tools/nuclei-importer. Severity is critical deliberately: it is what makes the rule act at all. The action field is not read by the engine \u2014 the decision is severity-derived score against the tenant threshold \u2014 so a sub-threshold rule neither blocks nor records anything."
+        },
+        {
+          "id": "EDGEGUARD-CHANNEL-SELFTEST-01",
+          "name": "Channel self-test (log only, withdrawn after the run)",
+          "pattern": "/edgeguard-channel-selftest-7f3a9c",
+          "targets": [
+            "uri"
+          ],
+          "action": "log",
+          "severity": "critical",
+          "category": "cve",
+          "enabled": true,
+          "origin": "Proves the one thing this channel has never shown: a published rule being read, applied and RECORDED without refusing anything. Safe to publish to every customer because the pattern is an invented path that exists on no site, and action log scores zero \u2014 so it can neither match ordinary traffic nor refuse it if it did. Withdrawn as soon as the run is read."
         }
       ]
     }