| name | security-digest |
| description | Monitor CVE feeds, security advisories, and vulnerability databases for content-relevant security news. Serves two purposes: article topics for News Researcher, and dependency/infrastructure alerts for Security Auditor. |
Security Digest
Security digest serves two audiences: the News Researcher (which CVEs make good article topics?) and the Security Auditor (which CVEs affect artstroy.net's dependencies?).
Sources to Monitor
CVE Feeds:
- NVD (National Vulnerability Database):
https://services.nvd.nist.gov/rest/json/cves/2.0?resultsPerPage=20&startIndex=0
- CISA KEV (Known Exploited Vulnerabilities):
https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json
Security News:
- PortSwigger Daily Swig:
https://portswigger.net/daily-swig/rss
- Krebs on Security:
https://krebsonsecurity.com/feed/
- OWASP Blog:
https://owasp.org/feed.xml
- GitHub Security Advisories (filter for Node.js/npm ecosystem)
Use EXA_API_KEY for semantic search when topic-based queries work better than feed scanning.
For News Researcher: Article Signals
A CVE or security story is article-worthy if:
- High CVSS score (≥7.0) AND affects widely-used tools (Node.js, npm ecosystem, Playwright, browsers)
- New attack technique that QA engineers or developers should know about
- OWASP-related (new OWASP guidance, updated Top 10 ranking)
- Illustrates a teachable moment (e.g., a real breach that shows why CSP matters)
Score using standard rubric (Relevance + Timeliness + Uniqueness, 1–5 each). Threshold: ≥10/15 for topic brief.
For Security Auditor: Dependency Alerts
When scanning NVD/GHSA, cross-reference against package.json dependencies in the artstroy repo. Flag any CVE that affects:
- Direct dependencies listed in
package.json
- Known transitive dependencies (check
bun.lockb)
- Development tooling (Astro, Playwright, Bun itself)
Alert format for Security Auditor:
### CVE-{year}-{id}: {package}@{version}
- **CVSS**: {score} ({severity})
- **Attack vector**: {network/local/physical}
- **Description**: {1-2 sentence summary}
- **Affected version in use**: {version from package.json or bun.lockb}
- **Fix**: upgrade to {safe version}
- **Deadline**: {based on SLA: CVSS≥9→1hr, 7-8.9→7days, 4-6.9→30days}
Create a vuln-fix issue if affected; assign to Security Auditor (who triages to DevOps or Frontend Engineer).
Cross-Cutting Escalation
If a CVE is both article-worthy and affects artstroy.net's stack:
- Notify Security Auditor immediately (technical fix)
- Create a
topic-brief for EIC (content opportunity once fix is deployed)
- Tag both issues with
cross-cutting and reference each other
This is the only case where News Researcher creates a vuln-fix issue — normally that's Security Auditor's domain.
