The visibility of the posts can now be configured via the configuration file (fedivuln/conf.py).

The value in the default configuration for the posts related to security advisories is set to ``unlisted``.o

Author: cedricbonhomme

CHANGELOG.md

@@ -1,5 +1,11 @@
 # Changelog
 
+## Release 1.4.0 (2026-01-08)
+
+The visibility of the posts can now be configured via the configuration file (``fedivuln/conf.py``).  
+The value in the default configuration for the posts related to security advisories is set to ``unlisted``.
+
+
 ## Release 1.3.3 (2026-01-08)
 
 Improved the display of the datePublished from cveMetadata.

fedivuln/conf_sample.py

@@ -29,6 +29,14 @@
     "on Vulnerability-Lookup:\n<LINK>\n\n#VulnerabilityLookup #Vulnerability #Cybersecurity #bot",
 }
 
+# The visibility of the status to posts is configarable per type of posts.
+status_visibility = {
+    "vulnerability": "unlisted",
+    "comment": "public",
+    "bundle": "public",
+    "sighting": "private",
+}
+
 
 # Regular expression to match CVE, GHSA, and PySec IDs
 vulnerability_patterns = re.compile(

fedivuln/config.py

@@ -32,6 +32,7 @@ def load_config(path):
     mastodon_clientcred = conf.mastodon_clientcred
     mastodon_usercred = conf.mastodon_usercred
     templates = conf.templates
+    status_visibility = conf.status_visibility
 
     vulnerability_patterns = conf.vulnerability_patterns
 

fedivuln/publish.py

@@ -135,11 +135,11 @@ async def create_status_content(event_data: str, topic: str) -> str:
 # ### Streaming functions
 
 
-def publish(message: str) -> None:
+def publish(message: str, visibility: str = "public") -> None:
     if message:
         print(message)
         try:
-            mastodon.status_post(message)
+            mastodon.status_post(message, visibility)
         except MastodonAPIError as e:
             print(
                 f"Mastodon instance returned MastodonAPIError - the server has decided it can't fulfil your request: {str(e)}"
@@ -178,7 +178,10 @@ def listen_to_http_event_stream(url, headers=None, params=None, topic="comment")
                         event_data = json.loads(data_line)
                         # print("Received JSON message:")
                         # print(message)
-                        publish(create_status_content_sync(event_data, topic))
+                        publish(
+                            create_status_content_sync(event_data, topic),
+                            config.status_visibility[topic],
+                        )
                     except json.JSONDecodeError:
                         # Handle plain text messages
                         print(f"Received plain message: {data_line}")
@@ -244,7 +247,10 @@ def main():
     if arguments.valkey:
         for elem in listen_to_valkey_stream(topic=arguments.topic):
             event_data = json.loads(elem)
-            publish(create_status_content_sync(event_data, arguments.topic))
+            publish(
+                create_status_content_sync(event_data, arguments.topic),
+                config.status_visibility[arguments.topic],
+            )
     else:
         combined = urljoin(config.vulnerability_lookup_base_url, "pubsub/subscribe/")
         full_url = urljoin(combined, arguments.topic)

pyproject.toml

@@ -5,7 +5,7 @@ build-backend = "poetry.core.masonry.api"
 
 [project]
 name = "FediVuln"
-version = "1.3.3"
+version = "1.4.0"
 description = "A client to gather vulnerability-related information from the Fediverse."
 authors = [
     {name = "Cédric Bonhomme", email = "cedric.bonhomme@circl.lu"}