daudmalik06

Hey Mate, we at Vulert have helped many companies to do part of it, i.e., keeping their software dependencies monitored for current and upcoming vulnerabilities without any code access or installation.

Feel free to reach out if it interests you.

dawood@vulert.com

I’ve been comparing several software composition analysis tools, including Vulert, to understand how differently they identify and prioritize vulnerable dependencies.

Most SCA products appear similar at first glance, but the results can vary significantly depending on features such as:

Detection of direct and transitive dependencies Support for lockfiles and package manifests Vulnerability database coverage and update speed Reachability or exploitability analysis Handling of withdrawn, disputed, or duplicate advisories Fix-version and dependency-upgrade recommendations SBOM generation and export formats CI/CD, GitHub, GitLab, and IDE integrations License-risk detection Support for repositories that cannot run an agent Noise reduction and false-positive handling

The most interesting difference is not always the number of vulnerabilities found. A tool that reports 100 issues may be less useful than one that clearly explains which five require immediate action.

I’m considering publishing a comparison using the same set of public repositories and measuring:

Vulnerabilities detected Transitive dependencies identified Actionable fixes provided False positives or duplicate findings Setup time Quality of the developer workflow

What features or test cases would you consider essential for a fair SCA comparison?

I’d especially like feedback from developers who have used tools such as Snyk, Mend, Dependabot, Trivy, Grype, osv-scanner, or Vuler

does it support php codebase ? specifically laravel ?

interesting, a question will it download the code ? how does it work technically ?

The approaches make sense for teams with engineering resources to build internal tooling. The LLM gateway layer is smart — virtual keys with caps is exactly the right mental model. The hard part is most solo devs and small teams never get around to building that layer, which is where the incidents happen. We built CloudSentinel specifically for that gap — automatic revocation on raw request count, no internal tooling required. Happy to share more if useful.

Original incident: https://www.reddit.com/r/googlecloud/s/3S1KWpWRZm

After reading about a 3-person startup that received an $82,000 Gemini API bill in 48 hours (normal monthly spend: $180), I started building CloudSentinel.

The core problem: GCP has no native kill switch. Budget alerts send an email. Quota limits throttle requests. Neither revokes a key automatically. And billing data is delayed by hours — useless for real-time protection.

The architecture:

CloudSentinel monitors raw API request count — updated in near real-time. We create an Alerting Policy inside the user's own GCP project using MQL. When the request threshold is crossed, Google fires a Pub/Sub webhook to CloudSentinel. We receive it and revoke that exact key automatically.

The security decision I'm most proud of:

Revoke-Only IAM model. The Custom IAM Role has three responsibilities: - Read API key IDs and metadata (never key values) - Create monitoring rules inside the user's project - Revoke a specific key when a threshold is crossed

The permission apikeys.create is not in the role. Not restricted — absent. Even if CloudSentinel is fully compromised, an attacker can only remove access, never create keys or touch anything else.

Early access open at https://cloudsentinel.dev

Have you ever dealt with a GCP billing surprise or a leaked key? Happy to hear your experience and discuss the architecture.

really thanks for kind suggestions, it really means a lot. i will save your comment and will try to test and validate what you suggested.

thanks again mate.

not a bad deal, perhaps :D

you can also reach out to me at ceo@vulert.com

Here's the link to our database: https://vulert.com/vuln-db/

please feel free to reach out at info@devnack.com

feel free to reach out to me at info@vulert.com

please feel free to reach out to me at info@vulert.com

It's based on advisories, so, it also includes vulnerabilities that are not given yet a cve,

This is why we at vulert.com never access the customer's codebase or any installation, who doesn't know vulert, it's a service that notifies you for security issues in your software dependencies.

Yes, basically this tool is relying on github advisories, which is included in our list.

Further, vulert is also 100% free for open source software.

even i was amazed to see the quick response

yes, both of these features are on our roadmap, get in touch with us to stay updated.

thanks

Well, actually we track all of the CVE lists, security advisories of vendors, package managers and as soon as there's an issue related to the software you use, we notify you. That's it.

Yeah, you can just upload a composer.lock file and that's it, we will track all of the open source you use and even the software that comes under first level. I.e we track the complete graph.

Feel free to contact us.

Yes, it can send real time notification of any open source you use e.g maven requirement file.

Most welcome

There are 2 problems with dependabot, 1: it requires you to have a code on github orherwise you can't receive alerts 2: they send months old alerts, even if you go to check security advisory of github, you'll notice the date of those issues will be very old.

This happens very often, Vulert.com is very useful in this case it notifies you as soon as a vulnerability found in any open source software you use.

Hi HN! We have developed new technology that helps companies to track the vulnerabilities in open source software they use, without sharing or integrating anything in the codebase.

This will help companies to be ready from future Log4J attacks. I’d love to get your feedback?

Best

A high severity vulnerability has been found in a widely used npm package "socket.io" with over 4M weekly downloads.

A high severity vulnerability has been found in a widely used npm package "extend2" with over 46K weekly downloads.

yeah agree, but with the help of real time notification you can move really quickly i think.

how can i connect with you? do you have an email to share? mine is daudmalik06 (@) gmail

Totally agree with you, i think it's time to think carefully and immediately start using services like Vulert(https://bit.ly/336DZub) that tracks your open-source softwares for free and notifies you in real-time if any seccurity issue is found within your applciation. it's free.

atleast in this way we can secure ourselves from supply chain attacks