Building VulnScanner: local-first vulnerability intelligence

I built VulnScanner because the vulnerability data pipeline was broken in a boring, invisible way. Teams were stitching together CSV downloads, spreadsheet trackers, and alert fatigue from tools that assumed the internet was always up and the database was always shared.

The problem

NVD data is public. It is huge. And for most small teams it is effectively unusable without a heavyweight enterprise platform. Either you pay for scanning, or you burn hours manually cross-referencing CVE lists against your own stack.

The approach

Local-first means three things for VulnScanner:

Sync once from NVD, store locally. No per-query network call.
Score locally by KEV and EPSS, not just CVSS. A 9.8 that never gets exploited is less urgent than a 7.5 that is.
Query offline. The library is yours, on your disk, queryable with no credentials.

What I learned

The hardest part was not ingestion. It was scoring policy. KEV and EPSS answer different questions, and combining them sensibly required talking to security folks who actually run triage, not just reading docs.

pip install vulnscanner
vulnscanner sync --nvd
vulnscanner query "openssl" --min-epss 0.1

The repo is open source under therayyanawaz/VulnScanner on GitHub. If you use it, issues and PRs are welcome.