daudmalik06
Feel free to reach out if it interests you.
Most SCA products appear similar at first glance, but the results can vary significantly depending on features such as:
Detection of direct and transitive dependencies Support for lockfiles and package manifests Vulnerability database coverage and update speed Reachability or exploitability analysis Handling of withdrawn, disputed, or duplicate advisories Fix-version and dependency-upgrade recommendations SBOM generation and export formats CI/CD, GitHub, GitLab, and IDE integrations License-risk detection Support for repositories that cannot run an agent Noise reduction and false-positive handling
The most interesting difference is not always the number of vulnerabilities found. A tool that reports 100 issues may be less useful than one that clearly explains which five require immediate action.
I’m considering publishing a comparison using the same set of public repositories and measuring:
Vulnerabilities detected Transitive dependencies identified Actionable fixes provided False positives or duplicate findings Setup time Quality of the developer workflow
What features or test cases would you consider essential for a fair SCA comparison?
I’d especially like feedback from developers who have used tools such as Snyk, Mend, Dependabot, Trivy, Grype, osv-scanner, or Vuler
Ask HN: Is there any founder building non AI startup in 2026?
Ask HN: Is there any founder building non AI startup in 2026 ?Just curious to know what other founders are building around and what are current challenges.
Tell HN: A company was billed $128K from one leaked GCP API key
I've been collecting real incidents over the past few months. The pattern is always identical:- $128,000 — small company in Japan, caught it at $44K, shut everything down, charges kept accumulating, Google denied the adjustment request- $82,314 — 3-person startup, Gemini API key silently reused, normal monthly spend was $180- $55,444 — student, key leaked on GitHub during summer break,...
After reading about a 3-person startup that received an $82,000 Gemini API bill in 48 hours (normal monthly spend: $180), I started building CloudSentinel.
The core problem: GCP has no native kill switch. Budget alerts send an email. Quota limits throttle requests. Neither revokes a key automatically. And billing data is delayed by hours — useless for real-time protection.
The architecture:
CloudSentinel monitors raw API request count — updated in near real-time. We create an Alerting Policy inside the user's own GCP project using MQL. When the request threshold is crossed, Google fires a Pub/Sub webhook to CloudSentinel. We receive it and revoke that exact key automatically.
The security decision I'm most proud of:
Revoke-Only IAM model. The Custom IAM Role has three responsibilities: - Read API key IDs and metadata (never key values) - Create monitoring rules inside the user's project - Revoke a specific key when a threshold is crossed
The permission apikeys.create is not in the role. Not restricted — absent. Even if CloudSentinel is fully compromised, an attacker can only remove access, never create keys or touch anything else.
Early access open at https://cloudsentinel.dev
Have you ever dealt with a GCP billing surprise or a leaked key? Happy to hear your experience and discuss the architecture.
$82K GCP bill in 48 hours – so I built an automatic API key kill switch
Show HN: Open-Source Security Monitoring with AI and License Compliance
Hey Hacker News, I’m Dawood, creator of Vulert. We’ve just released Vulert 2.0, a platform designed to monitor open-source dependencies for security vulnerabilities, ensure license compliance, and recommend fixes—without requiring access to your codebase or installation.---------- ---------- What's New in 2.0:License Compliance: Automatically checks if your open-source dependencies comply with...
Attention: RCE Vulnerability Discovered in Laravel
Attention Laravel developers: The Laravel RCE vulnerability in the "cookie" session driver exposes the encryption keys, allowing attackers to execute remote code on affected systems.https://vulert.com/vuln-db/packagist-laravel-framework-128248
thanks again mate.
Ask HN: We're tired and need your support
Dear Folks,It's been a challenging journey, nearly two years of relentless effort, and yet our startup has faced its fair share of setbacks. We've chosen to bootstrap our venture because we believe in proving our concept before asking anyone to invest their hard-earned money into it. However, despite our dedication, progress has been slow, and we've hit roadblocks right from the start.The...
Show HN: Compliant SBOM Management per US Senate Directive
Excited to introduce Vulert to the HackerNews community!As many are aware, the US government now mandates vendors to provide SBOMs (Software Bill of Materials) - essentially detailing the open-source components used within their products. At Vulert, we've developed a cutting-edge software composition analysis tool tailored for efficient SBOM management.# The challenge? New vulnerabilities in...
Show HN: Investment opportunity in a cyber security startup
Hey Folks, After months of hard work and dedication, we're thrilled to announce that #Vulert is taking a bold step forward. As we continue our mission to redefine the landscape of open-source software security, we're actively seeking visionary investors to join us on this transformative journey.# Why invest in Vulert?- Rapidly growing user base.- Tapping into a multi-billion-dollar market.-...
Show HN: Investment Opportunity in next Multi-Billion startup
Hey Folks,After months of hard work and dedication, we're thrilled to announce that #Vulert is taking a bold step forward. As we continue our mission to redefine the landscape of open-source software security, we're actively seeking visionary investors to join us on this transformative journey.Why invest in Vulert?Rapidly growing user base.Tapping into a multi-billion-dollar market.Innovative,...
please feel free to reach out at [email protected]
Show HN: A Revamped Vulnerability Database – Rapid and Detailed Reports
Hey Folks,We've just revamped our open-source vulnerability database and we're proud to say we're updating faster than most, including Snyk and Mend. Case in point: check out our comprehensive breakdown of CVE-2023-40582, which isn't yet on other platforms: https://vulert.com/vuln-db/CVE-2023-40582.Would love your feedback and insights . Together, we can make Vulert the go-to in open-source...
Show HN: Vulnerable dependencies in a NPM package with 840k weekly downloads
Attention!Vulert discovered over 30 vulnerable dependencies in enzyme-to-json npm package with 840k+ weekly downloads. Secure your code by reviewing the vulnerabilities here: https://vulert.com/vuln-scan/list/522d310a-10ea-4e45-8515-d5558e1aeff1Best
Show HN: Monitor security issues of 3rd party software you're using
Hacker Fellows,Thrilled to announce! Vulert can detect and monitor security issues within the Software Bill of Materials (SBOM) provided by your vendor.For those who may not be familiar, an SBOM is essentially a nested inventory or list of the various components that make up a software product. In fact, US Law now mandates that government agencies must obtain SBOMs for any new products they...
Show HN: Introducing Vulert, the Revolutionary SCA Tool
Hey there, fellow hackers!We're thrilled to introduce you to Vulert, an advanced SCA tool that makes monitoring and identifying open-source vulnerabilities in your software a breeze. With Vulert, you don't need to give us access to your code or go through a complicated installation process. Simply provide a manifest file (e.g. package-lock.json), and we'll do the rest for you in real-time!Want...
Database of more than 17K vulnerabilities
Thrilled to inform you that the vulnerability Database (https://vulert.com/vuln-db) is now live .To notify you in real time for security / Compliance issues, We're collecting the advisories from multiple sources including (Android, Packagist, npm, Maven, JavaScript, PyPI, NuGet, Ruby Gems, Go, Github, crates(.)io, DWF, GSD, Hex, Linux , OSS-Fuzz, UVI).If you don't know about Vulert, it...