Now that our database is rapidly filling with occurrences of vulnerabilities, it is time to start warning whenever a new vulnerability is found. Basically, every project that is analyzed should also rapidly be scanned for existing vulnerabilities.
If all goes well, this will deliver us with new vulnerabilities (kind of one of the most important things the project intends to do). If a vulnerability is found in one of the scanned projects, we want to get an email right away at notifications@secureseco.org.
There are three ways to implement this:
- Simply do a check command for each project, but that makes no sense, since we're adding the project to our database already.
- After analyzing a project, see if any vulnerable methods were stored.
- When a vulnerability is "hit" (so not in the find CVE github commit way) send an email.
Obviously, the first way should be avoided as it makes our spider/miner much slower and it effectively does double work.
Now that our database is rapidly filling with occurrences of vulnerabilities, it is time to start warning whenever a new vulnerability is found. Basically, every project that is analyzed should also rapidly be scanned for existing vulnerabilities.
If all goes well, this will deliver us with new vulnerabilities (kind of one of the most important things the project intends to do). If a vulnerability is found in one of the scanned projects, we want to get an email right away at notifications@secureseco.org.
There are three ways to implement this:
Obviously, the first way should be avoided as it makes our spider/miner much slower and it effectively does double work.