mindflayer
Hive Mind
Actively exploited

  • Recently added vulnerabilities that are being exploited in the wild, from CISA's Known Exploited Vulnerabilities catalog.

Source: CISA KEV catalog (opens in new tab). EPSS: estimated chance of exploitation in the next 30 days, from FIRST.org (opens in new tab). Information only, not advice for your environment. Talk to us if you're affected.

Provider incidents

From each provider's public status page, checked every 3 hours. Microsoft 365 shows the public consumer feed; business tenants should check their admin center.

Join the Hive Mind

The full daily brief by email: 5 to 10 exploited vulnerabilities, outages and headlines, in one short read.

What you get, and Pro →
Menu
Privacy policy · Last updated November 14, 2026

Privacy policy

Mindflayer ("we") runs mindflayer.com. This page explains what information the site collects and how it is used. We keep it short because we collect very little.

The domain security check

The check runs in your browser. Your browser asks mindflayer.com for public DNS records about the domain you enter, and our server looks them up through Cloudflare's public DNS resolver (cloudflare-dns.com); if that's unavailable, your browser asks Cloudflare's resolver directly. After each check, your browser also sends Mindflayer a short record: the domain, its grade and score, the time, where the check started (the form, our homepage or a shared link), your browser family and operating system (for example Chrome on Windows), and basic signals that help tell people from automated tools (such as whether the browser reports being automated and whether the page was used before the check ran). We don't store your IP address or your full browser details. We use this log to understand how the tool is used and to detect automated abuse, keep it for 90 days, and store it with Supabase, our database provider. Cloudflare's handling of those lookups is covered by the 1.1.1.1 resolver privacy policy. If your network blocks Cloudflare's resolver, your browser asks Google Public DNS (dns.google) instead, covered by the Google Public DNS privacy policy. Nothing is sent to the domain being checked.

GapMap Lite reads the files you add only inside your browser. Your files, device names and tool names never leave your browser. To understand how the tool is used, it sends Mindflayer anonymous usage counts (how many files, tools and devices you compared, and the coverage percentages), with your browser family and the same automation signals as the email check. We keep these counts for 90 days, stored with Supabase. We don't store your IP address.

IdentityMap Lite works the same way. It reads your Microsoft Entra ID exports only inside your browser, and your files, account names and sign-in names never leave it. It sends Mindflayer anonymous usage counts only (how many files and accounts you checked, how many are guests, disabled or admins, the MFA registration percentage and how many accounts each check found), with your browser family and the same automation signals as the email check. We keep these counts for 90 days, stored with Supabase. We don't store your IP address.

The IdentityMap and GapMap demo pages show made-up data only. To see whether they are useful, each visit sends Mindflayer how many clicks you made inside the demo and, if you follow one of the demo's own links (Resources, Lite, Get, Book a call), which one, with your browser family and the same automation signals as the email check. We keep these counts for 90 days, stored with Supabase. We don't store your IP address.

Contact, request and newsletter forms

When you send a form, we receive what you enter, such as your name, email, company, domain and message (and, for the careers form, your skills and profile link). Forms are processed by Formspree. We also keep a copy of what you send (except through the careers form) in our own database, hosted by Supabase, so we can manage requests and subscriptions. We use it to reply to you and, only if you subscribe or opt in, to send Field Notes, the Hive Mind brief and toolkit announcements. Every newsletter includes a way to unsubscribe, or you can email hello@mindflayer.com and we'll delete your information.

Hosting and fonts

The site is hosted on Cloudflare, which processes standard request data such as IP addresses to deliver and protect the site. Fonts are loaded from Google Fonts, which receives your IP address when the page loads.

What we don't do

We don't use advertising trackers or analytics cookies, and we don't sell or share your information.

Children

This site is intended for businesses and is not directed to children under 13. We don't knowingly collect information from children.

Contact

Questions or deletion requests: hello@mindflayer.com