Software keeps failing the same ways. It doesn’t have to.
CollectSEA (Collective Software Engineering Analogues) turns the public record of software, security and AI failures into safeguards that engineers and AI coding agents can use before they build.
Why this exists
The lessons are already written down. Companies publish postmortems, regulators publish findings and courts publish rulings. But they’re scattered, written after the damage, and rarely read by the next team building something similar.
AI raises the stakes. Coding agents change production systems quickly, and AI assistants act on email and documents with real permissions. They have no memory of the incidents that taught engineers about idempotency keys, staged rollouts or least privilege. CollectSEA gives them, and the people reviewing their work, that memory.
- Year2024CrowdStrikeOne faulty content update reached millions of Windows machines at once and grounded flights.Stage every global change
- Year2024Change HealthcareStolen credentials on a remote-access portal let attackers halt payments across U.S. healthcare.Phishing-resistant login on privileged paths
- Year2025ReplitAn AI coding agent deleted a live production database during a code freeze.Limits the agent can’t talk its way past
What makes it different
Evidence, not opinion
Every precedent links to the postmortem, filing, court record or advisory it comes from, and says how far it has been reviewed.
Before you build
Incident databases are usually read after something breaks. CollectSEA brings the lesson to the moment a design is cheapest to change.
Built for AI agents too
Coding agents now write a lot of the code. Over MCP, or with an AGENTS.md export, they can check a design against real failures first.
Mapped to standards
Patterns map to OWASP, NIST, CISA and CWE, so findings slot into requirements your security team already tracks.
Free, with open data
The website, API and MCP server are free, and the dataset is published under CC BY 4.0.
Honest about limits
Scores are published, weak matches are dropped, and evidence labels say exactly what each record is.
Built on public guidance
It puts into practice what U.S. agencies and standards bodies already ask for. The framework crosswalk has every mapping. CollectSEA is independent and not endorsed by any of them.
- NIST SSDF (SP 800-218)Model risk during design (PW.1.1) and analyze root causes so whole classes of problem stop recurring (RV.3).
- NIST SP 800-53 · SA-15(8)Use threat and vulnerability information from similar systems when building new ones.
- NIST AI RMF · MAP 5.1Weigh past uses of AI in similar settings, and public incident reports, when estimating impact.
- CISA Secure by DesignRemove whole classes of failure, like single-factor access and unpatched components.
Where it’s going
Created and maintained by Kelvin Ling, who designed the failure taxonomy, matching method, evidence model, MCP server and edge infrastructure. Suggestions, new incidents and corrections are welcome from anyone.
Progress lands in the changelog and shows up on the impact page.
- Next · 1
A human review of every documented incident
Each record checked against its source, with a second reviewer on a sample and published agreement rates. - Next · 2
More incidents, especially AI-agent failures
Growing the curated set, with a focus on agentic AI and the software critical services depend on. - Next · 3
An independent evaluation
Measuring whether precedents change what engineers and coding agents build, and publishing the results either way. - Next · 4
Deeper integrations
A GitHub App, IDE extensions and CI checks, so a design check happens without anyone having to remember it. - Next · 5
Citable releases
Versioned dataset snapshots with persistent identifiers that research and standards work can cite.
Privacy
No cookies, no trackers
No advertising, no third-party analytics scripts and no accounts.
Your design stays yours
The text you analyze is processed in memory and never saved. It only ends up in a URL if you make a share link.
Counted, not followed
Visits are counted with a daily hash that can’t identify anyone or follow them between days. See how.
Feedback is short-lived
Messages you send, and an email address if you add one, are kept for up to 90 days so we can reply.
Get in touch
Suggest an incident, report a record that looks wrong, propose a research collaboration, or just ask a question.