spaceraccoon/vulnerability-spoiler-alert

Vulnerability Spoiler Alert

Know about security patches before the CVE drops.

View Live Site | Subscribe via RSS

A monitoring hub that watches popular open-source repositories and uses AI to detect when commits are patching security vulnerabilities - often before a CVE is even assigned. Findings are published to a retro-themed website with an RSS feed.

Origin & Inspiration

This project is an example usage of spaceraccoon/vulnerability-spoiler-alert-action by Eugene Lim (@spaceraccoon).

The original concept and research is documented in the blog post Discovering Negative Days: LLM Workflows for Vulnerability Research, which explores using LLMs to identify security patches before CVEs are assigned - turning the typical "zero-day" into a "negative-day" by catching vulnerabilities in the window between the fix landing and public disclosure.

How It Works

                Every 6 hours
                      |
                      v
  +-------------------------------------------+
  |           GitHub Actions Cron             |
  +-------------------------------------------+
                      |
                      v
  +-------------------------------------------+
  |  vulnerability-spoiler-alert-action       |
  |  scans repos listed in the workflow       |
  +-------------------------------------------+
                      |
                      v
  +-------------------------------------------+
  |  Claude AI / OpenAI analyzes each diff   |
  |  - Is this a security patch?              |
  |  - What vulnerability does it fix?        |
  |  - Can we write a PoC exploit?            |
  +-------------------------------------------+
                      |
                      v
  +-------------------------------------------+
  |  Create GitHub Issue with full analysis   |
  +-------------------------------------------+
                      |
                      v
  +-------------------------------------------+
  |  Rebuild website + RSS                    |
  |  Deploy to GitHub Pages                   |
  +-------------------------------------------+

Monitored Repositories

Verifying Findings

Add labels to issues to classify findings:

A finding with true-positive but no cve:CVE-… label is verified — confirmed real but still in the "negative-day" window before a CVE drops. The CVE checker keeps re-checking verified findings until a CVE is matched.

The site automatically rebuilds when labels are added or removed.

Setup

1. Fork this repository

Click the Fork button at the top right.

2. Add secrets

Go to Settings > Secrets and variables > Actions and add either:

The GITHUB_TOKEN is provided automatically by GitHub Actions. You only need to add the key for the AI provider you intend to use.

Update monitor.yml to specify your preferred provider and model.

3. Enable GitHub Pages

Go to Settings > Pages and set source to GitHub Actions.

4. Enable workflows

Go to the Actions tab and enable workflows. The monitor runs every 6 hours automatically.

You can trigger it manually via Actions > Monitor Vulnerabilities > Run workflow.

Configuration

Monitored Repositories

Edit the repositories JSON array in .github/workflows/monitor.yml to add or remove repositories.

Cron Schedule

By default, the monitor runs every 6 hours. Edit the cron expression in .github/workflows/monitor.yml:

schedule:
  - cron: '0 */6 * * *'  # Every 6 hours

Architecture

• Zero dependencies - the site build script uses only Node.js built-in APIs
• Static site - plain HTML + RSS, deployed via GitHub Pages
• GeoCities theme - because security advisories deserve the Web 1.0 treatment

License

MIT License - see LICENSE for details.

Disclaimer

This tool is for defensive security research and authorized security testing only. Always follow responsible disclosure practices.