News for hackers. Stuff that matters.

daudmalik06

Hey Mate, we at Vulert have helped many companies to do part of it, i.e., keeping their software dependencies monitored for current and upcoming vulnerabilities without any code access or installation.

Feel free to reach out if it interests you.

[email protected]

Re: on Monday July 27, 2026 @06:39AM (#49067594)
I’ve been comparing several software composition analysis tools, including Vulert, to understand how differently they identify and prioritize vulnerable dependencies.

Most SCA products appear similar at first glance, but the results can vary significantly depending on features such as:

Detection of direct and transitive dependencies Support for lockfiles and package manifests Vulnerability database coverage and update speed Reachability or exploitability analysis Handling of withdrawn, disputed, or duplicate advisories Fix-version and dependency-upgrade recommendations SBOM generation and export formats CI/CD, GitHub, GitLab, and IDE integrations License-risk detection Support for repositories that cannot run an agent Noise reduction and false-positive handling

The most interesting difference is not always the number of vulnerabilities found. A tool that reports 100 issues may be less useful than one that clearly explains which five require immediate action.

I’m considering publishing a comparison using the same set of public repositories and measuring:

Vulnerabilities detected Transitive dependencies identified Actionable fixes provided False positives or duplicate findings Setup time Quality of the developer workflow

What features or test cases would you consider essential for a fair SCA comparison?

I’d especially like feedback from developers who have used tools such as Snyk, Mend, Dependabot, Trivy, Grype, osv-scanner, or Vuler

Re:Show HN: Keep .env.example in sync with Codebase on Tuesday March 31, 2026 @02:56PM (#47591856)
does it support php codebase ? specifically laravel ?
interesting, a question will it download the code ? how does it work technically ?
The approaches make sense for teams with engineering resources to build internal tooling. The LLM gateway layer is smart — virtual keys with caps is exactly the right mental model. The hard part is most solo devs and small teams never get around to building that layer, which is where the incidents happen. We built CloudSentinel specifically for that gap — automatic revocation on raw request count, no internal tooling required. Happy to share more if useful.

Tell HN: A company was billed $128K from one leaked GCP API key

I've been collecting real incidents over the past few months. The pattern is always identical:- $128,000 — small company in Japan, caught it at $44K, shut everything down, charges kept accumulating, Google denied the adjustment request- $82,314 — 3-person startup, Gemini API key silently reused, normal monthly spend was $180- $55,444 — student, key leaked on GitHub during summer break,...

( Read More... | 3 comments | 6 points | on HN )
Original incident: https://www.reddit.com/r/googlecloud/s/3S1KWpWRZm

After reading about a 3-person startup that received an $82,000 Gemini API bill in 48 hours (normal monthly spend: $180), I started building CloudSentinel.

The core problem: GCP has no native kill switch. Budget alerts send an email. Quota limits throttle requests. Neither revokes a key automatically. And billing data is delayed by hours — useless for real-time protection.

The architecture:

CloudSentinel monitors raw API request count — updated in near real-time. We create an Alerting Policy inside the user's own GCP project using MQL. When the request threshold is crossed, Google fires a Pub/Sub webhook to CloudSentinel. We receive it and revoke that exact key automatically.

The security decision I'm most proud of:

Revoke-Only IAM model. The Custom IAM Role has three responsibilities: - Read API key IDs and metadata (never key values) - Create monitoring rules inside the user's project - Revoke a specific key when a threshold is crossed

The permission apikeys.create is not in the role. Not restricted — absent. Even if CloudSentinel is fully compromised, an attacker can only remove access, never create keys or touch anything else.

Early access open at https://cloudsentinel.dev

Have you ever dealt with a GCP billing surprise or a leaked key? Happy to hear your experience and discuss the architecture.

Show HN: Open-Source Security Monitoring with AI and License Compliance

Hey Hacker News, I’m Dawood, creator of Vulert. We’ve just released Vulert 2.0, a platform designed to monitor open-source dependencies for security vulnerabilities, ensure license compliance, and recommend fixes—without requiring access to your codebase or installation.---------- ---------- What's New in 2.0:License Compliance: Automatically checks if your open-source dependencies comply with...

( Read More... | 1 comment | on HN )
Re:Ask HN: We're tired and need your support on Friday January 26, 2024 @11:40AM (#39144639)
really thanks for kind suggestions, it really means a lot. i will save your comment and will try to test and validate what you suggested.

thanks again mate.

Ask HN: We're tired and need your support

Dear Folks,It's been a challenging journey, nearly two years of relentless effort, and yet our startup has faced its fair share of setbacks. We've chosen to bootstrap our venture because we believe in proving our concept before asking anyone to invest their hard-earned money into it. However, despite our dedication, progress has been slow, and we've hit roadblocks right from the start.The...

( Read More... | 2 comments | 4 points | on HN )

Show HN: Compliant SBOM Management per US Senate Directive

Excited to introduce Vulert to the HackerNews community!As many are aware, the US government now mandates vendors to provide SBOMs (Software Bill of Materials) - essentially detailing the open-source components used within their products. At Vulert, we've developed a cutting-edge software composition analysis tool tailored for efficient SBOM management.# The challenge? New vulnerabilities in...

( Read More... | no comments | 2 points | on HN )

Show HN: Investment opportunity in a cyber security startup

Hey Folks, After months of hard work and dedication, we're thrilled to announce that #Vulert is taking a bold step forward. As we continue our mission to redefine the landscape of open-source software security, we're actively seeking visionary investors to join us on this transformative journey.# Why invest in Vulert?- Rapidly growing user base.- Tapping into a multi-billion-dollar market.-...

( Read More... | no comments | on HN )
not a bad deal, perhaps :D
you can also reach out to me at [email protected]

Show HN: Investment Opportunity in next Multi-Billion startup

Hey Folks,After months of hard work and dedication, we're thrilled to announce that #Vulert is taking a bold step forward. As we continue our mission to redefine the landscape of open-source software security, we're actively seeking visionary investors to join us on this transformative journey.Why invest in Vulert?Rapidly growing user base.Tapping into a multi-billion-dollar market.Innovative,...

( Read More... | 3 comments | 3 points | on HN )
Here's the link to our database: https://vulert.com/vuln-db/

please feel free to reach out at [email protected]

Show HN: A Revamped Vulnerability Database – Rapid and Detailed Reports

Hey Folks,We've just revamped our open-source vulnerability database and we're proud to say we're updating faster than most, including Snyk and Mend. Case in point: check out our comprehensive breakdown of CVE-2023-40582, which isn't yet on other platforms: https://vulert.com/vuln-db/CVE-2023-40582.Would love your feedback and insights . Together, we can make Vulert the go-to in open-source...

( Read More... | 1 comment | on HN )
feel free to reach out to me at [email protected]

Show HN: Monitor security issues of 3rd party software you're using

Hacker Fellows,Thrilled to announce! Vulert can detect and monitor security issues within the Software Bill of Materials (SBOM) provided by your vendor.For those who may not be familiar, an SBOM is essentially a nested inventory or list of the various components that make up a software product. In fact, US Law now mandates that government agencies must obtain SBOMs for any new products they...

( Read More... | 1 comment | on HN )
Re:Show HN: Introducing Vulert, the Revolutionary SCA Tool on Wednesday March 15, 2023 @02:55PM (#35173049)
please feel free to reach out to me at [email protected]

Show HN: Introducing Vulert, the Revolutionary SCA Tool

Hey there, fellow hackers!We're thrilled to introduce you to Vulert, an advanced SCA tool that makes monitoring and identifying open-source vulnerabilities in your software a breeze. With Vulert, you don't need to give us access to your code or go through a complicated installation process. Simply provide a manifest file (e.g. package-lock.json), and we'll do the rest for you in real-time!Want...

( Read More... | 1 comment | on HN )
Re:Database of more than 17K vulnerabilities on Sunday May 29, 2022 @12:03AM (#31546270)
It's based on advisories, so, it also includes vulnerabilities that are not given yet a cve,

Database of more than 17K vulnerabilities

Thrilled to inform you that the vulnerability Database (https://vulert.com/vuln-db) is now live .To notify you in real time for security / Compliance issues, We're collecting the advisories from multiple sources including (Android, Packagist, npm, Maven, JavaScript, PyPI, NuGet, Ruby Gems, Go, Github, crates(.)io, DWF, GSD, Hex, Linux , OSS-Fuzz, UVI).If you don't know about Vulert, it...

( Read More... | 2 comments | 5 points | on HN )
Re:Heroku CI and Review App Secrets Compromised on Tuesday May 24, 2022 @06:47PM (#31498446)
This is why we at vulert.com never access the customer's codebase or any installation, who doesn't know vulert, it's a service that notifies you for security issues in your software dependencies.
Yes, basically this tool is relying on github advisories, which is included in our list.

Older »