{"id":31582953,"url":"https://github.com/nicokempe/secscore","last_synced_at":"2026-05-16T08:02:32.050Z","repository":{"id":316764730,"uuid":"1064748671","full_name":"nicokempe/secscore","owner":"nicokempe","description":"🔍 PoC that enriches CVEs from public sources (NVD, EPSS, CISA, ExploitDB) and returns a time-aware SecScore for practical prioritization.","archived":false,"fork":false,"pushed_at":"2025-09-26T15:04:29.000Z","size":168,"stargazers_count":0,"open_issues_count":0,"forks_count":0,"subscribers_count":0,"default_branch":"main","last_synced_at":"2025-09-26T16:14:27.190Z","etag":null,"topics":["cvss","nitro","nuxt","secscore","security","threat-scoring","typescript","vulnerability-management"],"latest_commit_sha":null,"homepage":"https://secscore.nicokempe.de/","language":"TypeScript","has_issues":true,"has_wiki":null,"has_pages":null,"mirror_url":null,"source_name":null,"license":"apache-2.0","status":null,"scm":"git","pull_requests_enabled":true,"icon_url":"https://github.com/nicokempe.png","metadata":{"files":{"readme":"README.md","changelog":null,"contributing":null,"funding":".github/FUNDING.yml","license":"LICENSE","code_of_conduct":".github/CODE_OF_CONDUCT.md","threat_model":null,"audit":null,"citation":null,"codeowners":".github/CODEOWNERS","security":".github/SECURITY.md","support":null,"governance":null,"roadmap":null,"authors":null,"dei":null,"publiccode":null,"codemeta":null,"zenodo":null,"notice":null,"maintainers":null,"copyright":null,"agents":null,"dco":null,"cla":null},"funding":{"github":"nicokempe"}},"created_at":"2025-09-26T13:50:15.000Z","updated_at":"2025-09-26T15:04:33.000Z","dependencies_parsed_at":"2025-09-29T20:31:33.324Z","dependency_job_id":null,"html_url":"https://github.com/nicokempe/secscore","commit_stats":null,"previous_names":["nicokempe/secscore"],"tags_count":null,"template":false,"template_full_name":null,"purl":"pkg:github/nicokempe/secscore","repository_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/nicokempe%2Fsecscore","tags_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/nicokempe%2Fsecscore/tags","releases_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/nicokempe%2Fsecscore/releases","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/nicokempe%2Fsecscore/manifests","owner_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners/nicokempe","download_url":"https://codeload.github.com/nicokempe/secscore/tar.gz/refs/heads/main","sbom_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/nicokempe%2Fsecscore/sbom","scorecard":null,"host":{"name":"GitHub","url":"https://github.com","kind":"github","repositories_count":278537766,"owners_count":26003250,"icon_url":"https://github.com/github.png","version":null,"created_at":"2022-05-30T11:31:42.601Z","updated_at":"2022-07-04T15:15:14.044Z","status":"online","status_checked_at":"2025-10-05T02:00:06.059Z","response_time":54,"last_error":null,"robots_txt_status":"success","robots_txt_updated_at":"2025-07-24T06:49:26.215Z","robots_txt_url":"https://github.com/robots.txt","online":true,"can_crawl_api":true,"host_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub","repositories_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories","repository_names_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repository_names","owners_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners"}},"keywords":["cvss","nitro","nuxt","secscore","security","threat-scoring","typescript","vulnerability-management"],"created_at":"2025-10-05T23:56:15.964Z","updated_at":"2025-10-05T23:56:18.799Z","avatar_url":"https://github.com/nicokempe.png","language":"TypeScript","funding_links":["https://github.com/sponsors/nicokempe"],"categories":[],"sub_categories":[],"readme":"[![SecScore GitHub Banner](./.github/media/banner.svg)](https://github.com/nicokempe/secscore)\n\n## Description\n\nThis Security Score Proof of Concept is a lightweight Nuxt + Nitro web app that lets you paste any CVE ID and returns a time-aware threat score (SecScore) enriched with public signals (NVD, EPSS, CISA KEV, ExploitDB, OSV). After reading the paper [SecScore: Enhancing the CVSS Threat Metric Group with Empirical Evidences](https://arxiv.org/abs/2405.08539) and searching for an open, usable proof-of-concept I could not find one that matched the paper’s approach or my practical needs, so I decided to build this PoC to experiment with the model, combine it with real public feeds, and adapt the scoring and UX for realistic vulnerability prioritization. The project intentionally avoids a database (using Nitro caching and routeRules), exposes a simple UI and API, and keeps the model, parameters and evidence fully transparent for reproducible research and extension.\n\n## Features\n\n- 🔍 Enter any CVE ID and get an instant SecScore with current threat context\n- 🌐 Powered only by public data sources: NVD, EPSS, CISA KEV, OSV, and ExploitDB\n- ⚡ Lightweight design — no database, just Nitro caching and smart route rules\n- 📊 Combines CVSS base metrics with exploit probability and real-world signals\n- 📝 Transparent explanations show why a CVE is prioritized (PoC found, KEV flag, EPSS score)\n- 🎨 Clean and intuitive Nuxt frontend for quick lookups and demos\n- 🧩 Fully open-source, easy to extend with additional APIs or custom scoring logic\n\n## Development Guide\n\nThis project is built with **Nuxt 3 + Nitro** and uses **pnpm** as the package manager.\n\n### Prerequisites\n\n- [Node.js 22+](https://nodejs.org/en/)\n- [pnpm 9+](https://pnpm.io/) installed globally:\n\n  ```bash\n  corepack enable\n  corepack prepare pnpm@latest --activate\n  ```\n\n## Data sources \u0026 refreshing\n\n| Dataset                                                           | Purpose                                              | Refresh guidance                                                                                                                                                     |\n|-------------------------------------------------------------------|------------------------------------------------------|----------------------------------------------------------------------------------------------------------------------------------------------------------------------|\n| **CISA Known Exploited Vulnerabilities** (`server/data/kev.json`) | Flags vulnerabilities actively exploited in the wild | `curl -s https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json -o server/data/kev.json` then restart (or run `nitro task kev:refresh`) |\n| **ExploitDB snapshot** (`server/data/exploitdb-index.json`)       | Highlights public PoCs with publish dates            | Regenerate the curated JSON with `cveId`, `url`, and `publishedDate`; restart to load                                                                                |\n| **Model parameters** (`model-params/al-params.json`)              | Controls category-specific exploit timing curves     | Adjust `{ mu, lambda, kappa }` and redeploy/restart                                                                                                                  |\n\n## API surface\n\n| Endpoint                    | Method | Description                                                                                                                                          |\n|-----------------------------|--------|------------------------------------------------------------------------------------------------------------------------------------------------------|\n| `/api/v1/cve/:cveId`        | GET    | Returns normalised CVE metadata plus SecScore context. Validates identifiers, emits cache headers, and tags responses with `SecScore-Model-Version`. |\n| `/api/health`               | GET    | Exposes process uptime, CPU/memory usage, and KEV dataset metadata for monitoring.                                                                   |\n| `/api/internal/refresh-kev` | GET    | Triggers a KEV dataset refresh (protect behind auth when deploying).                                                                                 |\n\nThe public API routes inherit a per-IP rate limit of 120 requests per hour. Cache hits are labelled via an `X-Cache` header so you can monitor effectiveness.\n\n## Configuration\n\nThese environment variables customise behaviour at runtime:\n\n| Variable                          | Description                                                             |\n|-----------------------------------|-------------------------------------------------------------------------|\n| `CLOUDFLARE_TURNSTILE_SITE_KEY`   | Enables the Turnstile widget on the frontend when set.                  |\n| `CLOUDFLARE_TURNSTILE_SECRET_KEY` | Required to validate Turnstile tokens server-side.                      |\n| `LOG_LEVEL`                       | Sets client logging verbosity (default `info`).                         |\n| `LOG_REMOTE_ENABLED`              | When `true`, allows forwarding logs to `LOG_SERVER_URL`.                |\n| `LOG_SERVER_URL`                  | Remote logging endpoint (default `https://logs.secscore.net/api/logs`). |\n\n### Setup\n\nInstall all dependencies:\n\n```bash\npnpm install\n```\n\n### Development Server\n\nStart the development server on [http://localhost:3000](http://localhost:3000):\n\n```bash\npnpm dev\n```\n\nHot module replacement (HMR) is enabled, so changes are applied instantly.\n\n### Production\n\nBuild the application for production:\n\n```bash\npnpm build\n```\n\nPreview the production build locally:\n\n```bash\npnpm preview\n```\n\n### Deployment\n\nNuxt/Nitro supports multiple deployment targets (Node, serverless, edge, etc.).\nRefer to the [Nuxt Deployment Docs](https://nuxt.com/docs/getting-started/deployment) for configuration.\n\n## License\n\nThis project is licensed under the [Apache License](https://github.com/nicokempe/secscore/blob/main/LICENSE).\n","project_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fnicokempe%2Fsecscore","html_url":"https://awesome.ecosyste.ms/projects/github.com%2Fnicokempe%2Fsecscore","lists_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fnicokempe%2Fsecscore/lists"}