ZeroDayAttack — אגרגטור מודיעין AppSec

AppSec teams drown in fragmented intelligence: NVD in one place, CISA KEV in another, then EPSS, vendor PSIRTs, exploit PoCs, IOC feeds, MITRE ATT&CK and research RSS - each a different schema, cadence and trust level, and none prioritized for your specific stack. Turning that firehose into "what do I patch first, and is it actually being exploited" is manual, slow, and stale by the time it is finished. The opening was one normalized, real-time source of truth that reads as a public briefing and also drives a private remediation workflow - without a wall of false-urgency noise.

Built on Next.js 15 (App Router), TypeScript, Tailwind and Supabase (Postgres + Realtime + RLS) on Vercel. ~85 feeds are ingested on tiered Vercel crons (5-min / 30-min / daily / EPSS) into an append-only event log and merged into canonical records through a source trust order (NVD > vulnrichment > ZDI > GHSA > OSV > … > KEV > EPSS), with every outbound fetch behind an SSRF host allowlist. High-traffic public pages are ISR - served from the CDN yet still updating live, because Supabase realtime changes are merged into the TanStack Query cache; a per-request CSP-nonce "strict" mode for the workspace and a constant "content" CSP for cached pages keep both fast and locked down (anon RLS reads only; service-role key server-only). Public surfaces: a threat briefing, CVE feed, emerging-exploitation signals, CISA KEV zero-days, threat actors, IOCs, vendors, news, CWE/CVE detail, compare, search and source-health/status. The authenticated workspace turns intel into action: asset profiles personalize the patch queue, plus watchlists and alert channels, a triage bench, investigations, a query builder, remediation metrics (MTTR / SLA / burn-down) and integrations (Jira / Linear / ServiceNow / GitHub / SIEM). Federation-ready: a versioned REST API (`/api/v1`), OpenAPI docs, STIX 2.1 bundles, a TAXII 2.1 server and a CLI.