Originally, vulnerability reports, advisories, and exploits posted in various security lists enter the database as a new entry.
As of January, 2012, vulnerability entry was performed by full-time employees of the OSF.