💾 Archived View for capsule.adrianhesketh.com › 2018 › 12 › 18 › national-vulnerability-database-not… captured on 2023-09-28 at 16:20:42. Gemini links have been rewritten to link to archived content
⬅️ Previous capture (2021-11-30)
-=-=-=-=-=-=-
I've been using a few basic tools to notify me of vulnerabilities in repositories, for example, Github's automatic scanning of Node.js projects ([0]), but at a recent security audit, I realised that aside from this, I didn't have a process for being automatically alerted about other vulnerabilities.
So, I hacked something together over a weekend that periodically scans the USA's National Security Database [1] and notifies a Slack channel of vulnerabilities in Go and Node.js themselves. (I'll accept a pull request to make that configurable).
I've been working on some other security-related tools (taking a backseat to project work) but the other main tool I'm working on sends to an SNS topic instead of a Slack channel, which is actually more useful, so I might update the NVD notifier at some point.
It's written in Go, and uses the Serverless Framework to get deployed onto your own AWS environment. It uses DynamoDB to store state, which will cost a few dollars to run per month.
The code is over at [2]
Christmas 2018 Holiday Project - Raspberry Pi touchscreen alarm clock
IoT door sensor part 2 (now with annoying sounds and web view!)
