← All demos

Security Feeds Pipeline

For security teams without a threat-intel budgetLive · auto-updatingOpen live demo

Built with: GitHub Actions · Node.js (zero-dependency) · Next.js · Cloudflare Pages · Claude API

The problem

A small security team is told to "stay on top of threats". In practice that means a dozen browser tabs, a CVE firehose with no priority order, and an uneasy feeling that the one thing that matters is buried on page three. Threat-intel platforms solve this, but they are priced for teams with a SOC.

Who it's for

A security lead or platform owner at a company with no dedicated threat-intel function, who needs to answer one question every morning: is there anything here I need to act on today?

How it works

  • A scheduled GitHub Action runs twice a day and fetches around twenty sources: CISA KEV, NIST NVD, GitHub Security Advisories, FIRST EPSS, abuse.ch ThreatFox and URLhaus, malware and breach news, browser-extension threat data, and AI-security research.
  • Everything is normalised into one JSON file and committed. The repository is the database, and Cloudflare Pages rebuilds the static site on push.
  • Every item gets a risk rating that is deterministic and never AI-assigned: KEV-listed means critical, otherwise a CVSS × EPSS matrix decides.
  • Claude Haiku writes the plain-English summary, impact, and remediation for each new item, once, then caches it.
  • The page groups items into tabs (Top risks, Vulnerabilities, Malware & News, Breaches, Vendor Watch, AI Security, Browser Extensions, Threat Intel) with risk filters and search.

Try it

Open the live Security Feeds page. Start on Top risks, then switch to Vulnerabilities and filter to critical. The full build story is in The Blog Watches the Watchers.

The 30-second pitch

"You don't need a platform to know what to patch this week. This pulls the sources that matter, ranks them with a formula you can explain to an auditor, and writes the remediation in plain English. It runs on free infrastructure and nobody has to babysit it."

What I'd ask in a first call:

  1. How do you find out about a new exploited vulnerability today, and how long does it take?
  2. Who decides patch priority, and what do they base it on?
  3. Which of these sources would you trust, and which would you need to add for your stack?

Security properties

  • Feed content is treated as hostile input: sanitised, length-capped, rendered as text only. The LLM receives it strictly as data, with prompt-injection guards.
  • The fetcher has zero npm dependencies, so there is no supply chain inside a workflow holding a write token. Actions are pinned to commit SHAs and secrets are scoped to the one step that needs them.
  • Every source fails independently: a dead feed keeps its last good data with a visible "stale" badge.

Trade-offs and limits

  • Updates twice a day on GitHub's shared cron, which can lag by an hour or two. It is a morning briefing, not real-time alerting.
  • It watches public sources only. It knows nothing about your assets, so "critical" means critical in the world, not necessarily critical to you. Asset context is the obvious next layer.
  • AI summaries can be wrong. That is exactly why the risk rating never depends on them.