Cyber Pulse SG

Real-time cybersecurity news, aggregated from trusted sources and ranked by relevance.

Cyber Pulse fetches 18 RSS feeds: government and CERT advisories (CISA, NCSC, HKCERT), security journalism (Krebs on Security, BleepingComputer, The Hacker News, Dark Reading, …), APAC news (CyberSecAsia) and vendor threat research (Unit 42, Cisco Talos, …). Then it:

• tags each article with a category (Ransomware, APT, Vulnerability, AI, …)
• deduplicates the same story reported by several outlets, keeping the most authoritative copy and listing the others under "also"
• ranks by source tier, threat keywords, recency, how many outlets report it, Singapore relevance and exploitation signals; the top 5 from the last 24 hours become Top Stories
• enriches CVE IDs with CVSS scores from the NVD, CISA's Known Exploited Vulnerabilities (KEV) catalog and FIRST's EPSS exploitation forecast

flowchart LR
  F[18 RSS feeds] --> T[Tag] --> D[Deduplicate] --> R[Rank] --> E[Enrich CVEs] --> C[(Data cache<br/>15 min)]
  K[CISA KEV] --> R
  P[FIRST EPSS] --> R
  N[NVD CVSS<br/>kept 12h per CVE] --> E
  C --> Page[Page, per request<br/>CSP nonce]
  C --> API[JSON / RSS feeds<br/>ISR]

Article data is refreshed at most every 15 minutes (cached with Next.js's data cache); pages render per request so each gets a fresh Content-Security-Policy nonce.

Features

• Search (press /), source, category, time-window and triage filters (Has CVE, KEV, CVSS 9+, My stack) with Newest/Top sorting, all shareable via the URL; a card's source and category labels, and the 24h stat tiles, apply them in one click
• My stack: save the vendors and products you run; stories that mention them are marked on their cards and can be filtered to (stored in the browser)
• Grid/list view, "Load more" pagination
• Keyboard shortcuts: / search, j/k next/previous story
• NEW badges for stories published since your last visit, a count of them and "Mark all seen"; a notice when new stories mention your stack
• Singapore stories marked SG and ranked higher
• Bookmarks (/saved) and read tracking, stored in the browser; copy saved stories as a text briefing for chat, email or a ticket
• CVE detail dialog with CVSS score, vector, EPSS forecast, KEV status, references and the other current stories naming the CVE
• Trending names and CVEs from the last 24 hours (sidebar on desktop, chip strip on mobile)
• Top Stories capped at two per source; a footer explainer describes the ranking
• Warning banner when two or more feeds fail; if every feed fails, the last good page stays up
• An About page (/about) with the sources, ranking weights, data sources and privacy notes
• Accessible: keyboard navigable with a skip link, screen-reader labels, reduced-motion support
• Security headers (nonce CSP, HSTS, COOP, frame, referrer, permissions) and hardened feed parsing

Endpoints

Path	Description
/api/feed.xml	Ranked articles as RSS 2.0
/api/feed/kev, /api/feed/critical, /api/feed/cve, /api/feed/sg	RSS of only known-exploited, CVSS 9+, CVE or Singapore stories (for a reader or chat channel)
/api/feed.json	Ranked articles as JSON: { lastUpdated, count, failedFeeds, featured, recent } (CORS-enabled); each article's cves carry cvss, severity, kev and epss/epssPercentile where known
/api/health	Feed health: { status, feedsUp, feedsDown, failedFeeds, kev, dataUpdated, lastCheck } (at most ~60s old); degraded if a feed is down or the page data is over an hour old
/api/cve/:id	CVE details from the NVD plus KEV status and EPSS (cached 1h); only CVEs in current stories

Development

Requires Node.js 20.9 or later.

npm install
npm run dev      # http://localhost:3000
npm test         # unit tests (Vitest); npm run test:coverage adds coverage thresholds
npm run test:e2e # end-to-end tests (Playwright) against a local fixture feed
npm run check:feeds # live check that every feed fetches (network; also runs daily in CI)
node scripts/smoke.mjs <url> # smoke-test a deployment (runs after each Production deploy)
npm run lint
npm run build

Feed sources and their tiers live in lib/feeds.ts; ranking keywords in lib/ranker.ts; category rules in lib/tagger.ts. See CLAUDE.md for the architecture and conventions.

Configuration

All optional:

Variable	Purpose
NVD_API_KEY	NVD API key; raises new CVE lookups per refresh from 5 to 20, so CVSS coverage fills in faster (scores are kept 12h per CVE)
NEXT_PUBLIC_SITE_URL	Absolute site URL for feed and canonical links. Defaults to the Vercel production domain

Deployment

Deployed on Vercel. GitHub Actions:

• CI on every push to main and on pull requests: production-dependency audit, lint, typecheck, unit tests with coverage thresholds, a production build and the Playwright end-to-end suite (with axe accessibility audits)
• Feed health daily: every feed must fetch and parse; a failed run flags a broken source. Run it by hand with a feeds JSON input to vet a new source.
• Production smoke test after each Production deploy. Set the repository variable PRODUCTION_URL to the public domain (deployment URLs are usually behind Vercel Authentication, in which case the run is skipped).

Dependabot proposes dependency updates weekly.