Developer builds governed VEX platform using Next.js and Trivy to streamline CVE triage

·1 views

A developer has published an open-source demo showing how to replace ad-hoc vexctl scripts with a structured VEX (Vulnerability Exploitability eXchange) platform built on Next.js and keyless signing. The project targets the PingAccess 8.3.4-edge container image, which initially returned 70 vulnerability findings across critical, high, medium, and low severities when scanned with Trivy. Using vexctl, individual VEX statements are generated per CVE, pinned to the image digest rather than a tag, then merged into a single OpenVEX document that reduces reported findings from 70 to zero. The suppressed findings are not deleted but remain fully auditable in Trivy's output with justifications attached. The demo repository and a one-script setup are publicly available on GitHub, though the author cautions that all CVEs are marked 'not_affected' mechanically for workflow testing and should not be replicated without genuine security assessment.

Read the full story at DEV Community

This is an AI-generated summary. ShortSingh links to the original source for the complete article.

Discussion (0)

Developer Builds Arcade Game to Visualize How Vector Databases Work

A developer has created a retro-style arcade game called Vector Strike to help users understand how vector databases such as Pinecone, Milvus, and Qdrant perform semantic search. The game lets players act as a vector database administrator, adjusting settings like similarity thresholds, embedding dimensions, and indexing methods to defend index nodes. Each in-game mechanic directly mirrors a real production concept, such as how reducing embedding dimensions causes semantic overlap and false matches. Players can also toggle between brute-force flat scanning and HNSW graph-based indexing to see how proximity graphs speed up nearest-neighbor search. The project aims to make abstract concepts like cosine similarity and high-dimensional embeddings more intuitive through interactive, visual gameplay.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

Developer Rebuilds AES Encryption Tool With Full Browser-Side Processing

A developer has relaunched aesencryption.net, a free online tool that performs AES encryption and decryption — supporting 128, 192, and 256-bit keys — entirely within the user's browser, ensuring no data leaves the page. The rebuild focused on maintaining byte-level compatibility with common server-side AES libraries across multiple languages. To support this, the site includes copy-paste code equivalents in PHP, Java, Python, Go, Rust, Kotlin, and JavaScript. The tool handles key technical details such as encryption mode, initialization vectors, padding, and Base64 output. The developer has made the tool publicly available at no cost and is actively seeking community feedback on the cryptographic design choices.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

How to Self-Host Plausible Analytics with Docker, Nginx, and Let's Encrypt

Plausible Analytics is an open-source, privacy-focused web analytics platform that collects traffic data without using cookies or personal identifiers, serving as an alternative to Google Analytics. A step-by-step deployment guide covers setting up Plausible Community Edition using Docker Compose, with PostgreSQL and ClickHouse handling the underlying databases. Nginx is configured as a reverse proxy to route public traffic to the locally bound application, and a free Let's Encrypt TLS certificate is issued via Certbot to secure the connection over HTTPS. Once deployed, users register an admin account, add their website, and embed a lightweight JavaScript snippet to begin capturing live traffic statistics. The setup also supports multi-site tracking, scheduled email or Slack reports, and a Stats API for custom data exports.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

AI Engineer World's Fair 2025: Key Takeaways on Agents and Logging

Ishaan Sehgal of Daily Context covered the AI Engineer World's Fair in a piece published on June 30. The article, titled 'The Log Is the Agent,' explores themes around AI agents and the role of logging in agentic systems. The piece was shared on DEV Community and received 48 reactions from readers. The coverage falls under the topics of AI engineering and agent-based architectures.

0 comments Read more at DEV Community