🛡️ VulnSight

Modern Vulnerability Intelligence platform for software component analysis and security automation.

VulnSight is an open-source Vulnerability Intelligence platform designed to automate the collection, analysis and management of software component vulnerabilities.

The project continuously retrieves vulnerability information from trusted sources such as the National Vulnerability Database (NVD), stores it in a PostgreSQL database and exposes a REST API for querying, filtering and integrating vulnerability intelligence into security workflows.

The goal of VulnSight is to demonstrate modern Security Automation, Vulnerability Management and Software Supply Chain Security practices while providing a production-inspired architecture suitable for learning and portfolio purposes.

---

Features

• CVE collection from the NVD API
• Automated vulnerability synchronization
• PostgreSQL database for persistent storage
• REST API built with FastAPI
• Dockerized development environment
• Security-focused architecture
• CI/CD with GitHub Actions
• Extensible design for additional package ecosystems

---

Architecture

                NVD API
                   │
                   ▼
         Vulnerability Collector
                   │
                   ▼
             PostgreSQL
                   │
                   ▼
             FastAPI Backend
                   │
                   ▼
              REST API Clients

Future versions will support:

• PyPI
• npm
• Maven
• NuGet
• SBOM ingestion
• Automated notifications
• Dashboard

---

Tech Stack

Technology	Purpose
Python	Backend
FastAPI	REST API
PostgreSQL	Database
Docker	Containerization
GitHub Actions	CI/CD
NVD API	Vulnerability Source

---

Project Structure

VulnSight/

├── app/
├── tests/
├── docs/
├── docker/
├── .github/
├── docker-compose.yml
├── README.md
└── requirements.txt

---

Quick Start

Clone the repository

git clone https://github.com/yourusername/VulnSight.git

cd VulnSight

Run the project

docker compose up --build

The API will be available at

http://localhost:8000

Swagger Documentation

http://localhost:8000/docs

---

Roadmap

Version 1

• NVD integration
• PostgreSQL integration
• FastAPI REST API
• Docker Compose
• Basic unit tests

Version 2

• Package repository integration (PyPI)
• Vulnerability search
• CVSS filtering
• Scheduler for automatic synchronization

Version 3

• Dashboard
• Authentication
• Notifications
• SBOM support

---

📖 Learning Objectives

This project focuses on developing practical experience with:

• Vulnerability Intelligence
• CVE / NVD
• Software Supply Chain Security
• Component Analysis
• Security Automation
• Docker
• PostgreSQL
• FastAPI
• REST APIs
• CI/CD
• DevSecOps

---

Contributing

Contributions, ideas and suggestions are welcome.

Feel free to open an Issue or submit a Pull Request.

---

License

MIT License

---