Security Feeds Pipeline

Security Feeds is the live threat-intel page on this site. And the infrastructure behind it is the actual project: proof that a serverless static site can run a real, reliable intelligence pipeline.

How it works

• A scheduled GitHub Action wakes twice a day, fetches 9+ sources (CISA KEV, NIST NVD, GitHub Security Advisories, FIRST.org EPSS, SANS ISC, abuse.ch ThreatFox/URLhaus, arXiv, AI Incident Database, Embrace The Red), normalises everything into one JSON file, and commits it: the repo is the database, and Cloudflare Pages rebuilds on push.
• Every item carries summary, impact, remediation, and a risk rating. Risk is deterministic and never AI-assigned: KEV-listed → critical, otherwise a CVSS × EPSS matrix.
• Claude Haiku writes the human-readable summaries and remediation notes: each new item enriched exactly once, cached forever, for pennies a day.

Security properties (it practises what the blog preaches)

• Feed content is treated as hostile input: sanitised, length-capped, entity-decoded, rendered as text only; the LLM receives it strictly as data with prompt-injection guards.
• The fetcher has zero npm dependencies: no install step, no supply chain inside a workflow holding a write token. Actions are pinned to commit SHAs; secrets are scoped to the one step that needs them.
• Every source fails independently: a dead feed keeps its last-good data with a visible "stale" badge, and only files an issue after a week of silence.

Why it matters

"Real-time security visibility" is usually sold as a platform subscription. This is the counter-example: fetch → normalise → commit, on free infrastructure, maintained by nobody. The build story is on the blog: The Blog Watches the Watchers.