Blog

As a fun marketing challenge, we built an EU discovery pipeline that finds public GitHub organizations, scans their public repositories, and prepares curated vulnerability fix guidance we can share with each team.

We scanned the public yasasbanukaofficial/claude-code mirror with Verimu. Because the leaked source did not include package manifests, we reconstructed package.json and package-lock.json from imports, then ran an offline vulnerability scan. Here are the findings and risk assessment.

No UI, no heavyweight platform, just a local CVE ingestion pipeline in Postgres. More or less, this is how our system handles full weekly baseline syncs and hourly updates.

CVE, NVD, OSV, GHSA, RHSA, USN, PYSEC, RUSTSEC, and dozens more. Here's a practical model for how these systems fit together, why the ecosystem feels fragmented, and what the advisory prefixes actually mean in production data.

CycloneDX, SPDX, and SWID all describe software, but they solve different problems. If you're trying to meet CRA obligations, exchange SBOMs with customers, or standardize your software inventory, here's what each format is for and when to use it.

The EU Cyber Resilience Act's first real deadline hits September 11, 2026. From that date, you must report actively exploited vulnerabilities within 24 hours. If you don't have SBOMs and CVE monitoring in place, you can't comply. Here's what you need to know — and what your options are.

Getting "Component requires at least one valid identifier (PURL or CPE)" for @types/node or @angular/core? The @ sign in scoped npm packages must be percent-encoded as %40 in PURLs. Here's why, and how to fix it.

Your CycloneDX SBOM fails NTIA validation because of missing supplier fields. Here's exactly what those errors mean, where they come from, and how to fix them — with the CycloneDX 1.7 spec.