Cyberowlai

CyberOwl Security Check

Cross-reference recent cybersecurity alerts from 10 international CERTs against the user's project to surface vulnerabilities that actually matter to them.

High-level workflow

1. Discover the project's full tech stack (dependencies, infra, frameworks)
2. Fetch the alert feed from https://cyberowlai.com/alerts.json
3. Match alerts against the stack using tiered confidence
4. Report only what's relevant, plus always-flag critical alerts

Run steps 1 and 2 in parallel when possible — don't make the user wait.

Step 1 — Deep project discovery

Build a comprehensive inventory. Go beyond top-level deps — look at transitive dependencies, container base images, CI tool versions, and code import patterns.

1a. Find all dependency and config files

Use Glob to locate files. Search for all of the following (skip categories that return nothing):

1b. Read discovered files and extract

From each file, extract:

• Package names and versions (direct + transitive where lock files exist)
• Base images from Dockerfiles (FROM lines) — note the OS, runtime, and version
• System packages installed via apt-get install, apk add, yum install
• Action versions from CI workflows (e.g. actions/checkout@v4)
• Cloud providers from Terraform (provider "aws", resource prefixes)
• Database types from ORMs, connection strings, Docker services
• Service names from env variable patterns (REDIS_URL, POSTGRES_HOST, MONGO_URI, KAFKA_BROKER)

1c. Grep for framework and library patterns in code

Use Grep to detect frameworks and libraries that might not appear in dependency files. Search source directories for these import patterns:

• Frameworks: import express, from django, import spring, using Microsoft.AspNetCore, import React, import Vue, from angular
• Auth: passport, jsonwebtoken, jwt, oauth, auth0, firebase-auth, keycloak
• Crypto: bcrypt, argon2, crypto, openssl, sodium
• HTTP clients: axios, fetch, requests, httpx, okhttp, urllib3
• Message queues: rabbitmq, kafka, celery, bull, sidekiq, nats
• Cloud SDKs: aws-sdk, @google-cloud, azure, boto3

1d. Compile the stack inventory

Organize everything you found into a structured inventory:

• Languages (with versions where known)
• Frameworks (with versions)
• Direct dependencies (key ones — no need to list every tiny utility)
• Databases & data stores
• Infrastructure (container images, cloud providers, orchestration)
• CI/CD (platform and notable tool versions)
• Web servers & proxies
• Security tools already in use

This inventory drives the matching in Step 3 and is shown to the user in the final output so they can verify completeness.

Step 2 — Fetch the alert feed

Use WebFetch to retrieve https://cyberowlai.com/alerts.json.

The JSON structure:

{
  "generated_at": "2026-04-23T10:00:54Z",
  "sources": {
    "<SOURCE_NAME>": {
      "items": [
        {
          "title": "...",
          "link": "https://...",
          "description": "...",
          "date": "Apr 20, 2026"
        }
      ]
    }
  }
}

Sources: US-CERT, CERT-FR, MA-CERT, IBM-X-FORCE-EXCHANGE, ZERODAYINITIATIVE, OBS-Vigilance, VulDB, HK-CERT, CA-CCS, EU-CERT (~90 alerts total).

If the fetch fails: Tell the user the feed is unavailable, suggest they check https://cyberowlai.com/activity/ directly, and still show the detected stack inventory so the visit isn't wasted.

Step 3 — Intelligent matching

Cross-reference every alert's title and description against the full stack inventory. Classify matches into tiers:

HIGH — Direct dependency or component match

The alert explicitly names a package, library, or tool the project uses.

Examples:

• Alert says "jQuery 3.6 vulnerability" → project has jQuery → MATCH
• Alert says "OpenSSL" → Dockerfile installs openssl → MATCH
• Alert says "nginx" → docker-compose has nginx service → MATCH
• Alert says "PostgreSQL" → project uses PostgreSQL → MATCH