exploit-watch-archive

A durable, private aggregation of the exploit/PoC source repos tracked by the #exploit-watch monitoring task. Each monitored upstream is snapshotted (its files copied in), not linked as a submodule — so the content survives even when an upstream repo is deleted or DMCA'd, which happens routinely with 0-day disclosure repos.

It aggregates weaponised and, in several cases, unpatched 0-day PoC code (e.g. WinRE→BitLocker bypass, GitLab Oj RCE chain). Mirroring privately for internal defensive / remediation use is defensible; public re-hosting is not — many upstreams carry no license (default all-rights-reserved), so the per-source provenance in SOURCES.md is what keeps this auditable.

Layout

sources.json                 # the list of upstream repos to archive (edit this)
sync.sh                      # clones each upstream @HEAD and snapshots it into sources/<name>/
MANIFEST.json                # machine-readable provenance (regenerated each sync)
SOURCES.md                   # human-readable provenance table (regenerated each sync)
sources/<name>/              # snapshot of each upstream's working tree at the recorded commit
.github/workflows/sync.yml   # scheduled Actions job that runs sync.sh and commits the diff

Every sync records, per source: origin repo, the exact commit SHA, the upstream commit date, the pull timestamp, file count, and reachability status. If an upstream is unreachable on a given run, its previous snapshot is kept and the manifest marks it unreachable.

The below are not required, these were part from my process, I'm leaving it just in case someone wants to do a private repo on his own.

---

One-time setup

1. Create a private repo on GitHub named exploit-watch-archive (empty, no README).
2. Push this scaffold to it:

   cd exploit-watch-archive
   git init -b main
   git add -A
   git commit -m "scaffold: exploit-watch durable archive"
   git remote add origin git@github.com:<your-org-or-user>/exploit-watch-archive.git
   git push -u origin main

3. In the repo: Settings → Actions → General → Workflow permissions → select "Read and write permissions" (lets the scheduled job commit snapshots).
4. (Optional) Trigger the first run now: Actions → sync-archive → Run workflow. Otherwise it runs automatically Mon & Thu 06:15 UTC.

Running it yourself (instead of / in addition to Actions)

sync.sh needs bash, git, and jq.

./sync.sh            # refresh snapshots + manifest, leave changes unstaged
COMMIT=1 ./sync.sh   # also stage + commit locally

Adding a new source

Append an object to sources.json (name = folder name, repo = owner/name) and run sync.sh. The #exploit-watch digest's "promoted" repos should be added here so the archive and the watch list stay in lockstep.

Notes

• Snapshots are shallow (HEAD only) — the archive stores current content, not full upstream git history. This keeps the repo size manageable (e.g. the evm-hack-poc source alone is >1,300 files).
• rsync --delete means files removed upstream are removed from the snapshot on the next sync; the previous state remains recoverable from this repo's own git history.
• The default schedule matches the exploit-watch cadence (Mon & Thu). Adjust the cron in .github/workflows/sync.yml if you want it more/less frequent.