security-digest

name	security-digest
description	Monitor CVE feeds, security advisories, and vulnerability databases for content-relevant security news. Serves two purposes: article topics for News Researcher, and dependency/infrastructure alerts for Security Auditor.

Security Digest

Security digest serves two audiences: the News Researcher (which CVEs make good article topics?) and the Security Auditor (which CVEs affect artstroy.net's dependencies?).

Sources to Monitor

CVE Feeds:

• NVD (National Vulnerability Database): https://services.nvd.nist.gov/rest/json/cves/2.0?resultsPerPage=20&startIndex=0
• CISA KEV (Known Exploited Vulnerabilities): https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json

Security News:

• PortSwigger Daily Swig: https://portswigger.net/daily-swig/rss
• Krebs on Security: https://krebsonsecurity.com/feed/
• OWASP Blog: https://owasp.org/feed.xml
• GitHub Security Advisories (filter for Node.js/npm ecosystem)

Use EXA_API_KEY for semantic search when topic-based queries work better than feed scanning.

For News Researcher: Article Signals

A CVE or security story is article-worthy if:

1. High CVSS score (≥7.0) AND affects widely-used tools (Node.js, npm ecosystem, Playwright, browsers)
2. New attack technique that QA engineers or developers should know about
3. OWASP-related (new OWASP guidance, updated Top 10 ranking)
4. Illustrates a teachable moment (e.g., a real breach that shows why CSP matters)

Score using standard rubric (Relevance + Timeliness + Uniqueness, 1–5 each). Threshold: ≥10/15 for topic brief.

For Security Auditor: Dependency Alerts

When scanning NVD/GHSA, cross-reference against package.json dependencies in the artstroy repo. Flag any CVE that affects:

• Direct dependencies listed in package.json
• Known transitive dependencies (check bun.lockb)
• Development tooling (Astro, Playwright, Bun itself)

Alert format for Security Auditor:

### CVE-{year}-{id}: {package}@{version}
- **CVSS**: {score} ({severity})
- **Attack vector**: {network/local/physical}
- **Description**: {1-2 sentence summary}
- **Affected version in use**: {version from package.json or bun.lockb}
- **Fix**: upgrade to {safe version}
- **Deadline**: {based on SLA: CVSS≥9→1hr, 7-8.9→7days, 4-6.9→30days}

Create a vuln-fix issue if affected; assign to Security Auditor (who triages to DevOps or Frontend Engineer).

Cross-Cutting Escalation

If a CVE is both article-worthy and affects artstroy.net's stack:

1. Notify Security Auditor immediately (technical fix)
2. Create a topic-brief for EIC (content opportunity once fix is deployed)
3. Tag both issues with cross-cutting and reference each other

This is the only case where News Researcher creates a vuln-fix issue — normally that's Security Auditor's domain.