Rozhanisty devlog #1: laying the foundation

Started Rozhanisty today — a tool that pulls vulnerability data from the NIST NVD API and lets a CLI scanner check local software for known CVEs against installed versions.

Spent most of today on the database schema instead of anything flashy, but this is the part that has to be right before anything else works:

• vendors / products — normalized so a vendor (e.g. wordpress) can have multiple products (core, plugin, theme, etc.), since NVD data is a mess of vendor/product pairs that need de-duping.
• cpe_maps — maps NVD’s CPE vendor/product strings to my normalized vendor/product, with exact vs fuzzy match types since NVD naming is inconsistent and I’ll need fuzzy matching for products that don’t map 1:1.
• vulnerabilities — the actual CVE records: CVSS score/vector/version, description, published/modified dates, and the raw CPE config as JSON so I don’t lose data while I figure out matching logic.
• vulnerability_ranges — the important one. Each CVE can affect multiple version ranges per component, so this breaks it out with version_start/version_end (inclusive flags included, because NVD ranges are sometimes open-ended) and a match_confidence enum so the scanner can flag “we’re not 100% sure this applies to you.”

Stack is Laravel on the backend (queues will probably handle the NVD pulls later) with Vue for whatever dashboard/UI ends up existing for making API keys.

Next up: writing the ingestion job that actually pulls from the NVD API and populates these tables.