Personal project, built with an AI coding assistant
secnews
A tool that reads cybersecurity news feeds, pulls out the CVE numbers they mention, looks up each official score and shows a short list of what needs a decision today. It runs on my own machine and stores everything in a local SQLite database.
My role
I set the requirements and the scope, made the design decisions and reviewed the work. Claude Code, an AI coding assistant, wrote the code under my direction.
Built with
How it works
- It reads the RSS feeds of five security sites on a schedule, including Krebs on Security, The Hacker News, BleepingComputer and CISA Advisories. It skips an article it has already stored, by URL or by a hash of the content.
- It extracts CVE identifiers and any CVSS score quoted next to them. If no score is found, the CVE is marked Unrated. It is never guessed.
- After each scrape it asks the NIST National Vulnerability Database for the official score of each CVE found. Only the CVE number is sent. The official score replaces the one an article quotes, and a CVE whose articles disagree with NVD is flagged.
- The same CVE from several sources shows as one row with a source count. The CVE page shows each source's score, your notes and what happened to it.
The dashboard
- Today lists CVEs that match the products on my watchlist, then critical ones reported as exploited. Each can be marked Reviewed or snoozed, with an Undo bar.
- Threats lists every CVE from the last 30 days with state tabs, severity filters and search.
- Watchlist and alerts holds the products I run and the alert rules. Alerts can go to Slack, email or a webhook. They ship switched off, and a rule alerts once per CVE unless the score rises or exploitation is first reported.
- System shows source health, a run log and settings.
Fetching politely and keeping it safe
- It uses RSS feeds, checks robots.txt before every fetch, waits a second between requests to a host and identifies itself in the User-Agent.
- SecurityWeek blocked the tool with HTTP 403. I switched that source off instead of disguising the User-Agent.
- Secrets such as the Slack webhook or an NVD API key are read from environment variables and never stored in the config file.
- The dashboard binds to 127.0.0.1 only and every form post carries a CSRF token. There are no user accounts, so it is not meant to be exposed to a network.
- The tests use saved feed fixtures and a fake HTTP session, so they make no network calls.
Limits
- Score extraction is pattern-based. It finds common phrasings such as "CVSS 9.8" but not every one, and the "affected software" text is a best guess.
- A watchlist match is a hint. It matches product names in headlines and summaries and does not know which version I run.
- It is a lead generator. Severity, affected versions and fixes still need confirming in the vendor advisory or the NVD before acting.
- It has no digest mode, and it is built for one person on one machine.
Screenshots
Screenshots show live data from my own instance. The headlines are from public news sites.