I Built a Vulnerability Triage Tool Without Knowing What EPSS or KEV Meant

<p>I've been writing software professionally since 2011.</p> <p>Java, C#, Kotlin, Node.js. Enterprise backends, microservices, APIs, data pipelines. I've shipped production code

<p>A critical vulnerability on an Alpine-based reverse proxy sitting behind three layers of network controls isn't actually critical.</p> <p>A medium-severity finding on the

<p>Generate a CycloneDX SBOM and deterministic, audit-ready risk report from your package-lock.json.</p> <p>You run npm audit. It says “47 vulnerabilities.”</p> <p>Cool.</p>

<blockquote> <p><em>A tool should do one thing, do it well, and — this is the part everyone forgets — know exactly where its knowledge ends.</em></p> </blockquote> <p>I built

<p>In January and February 2026, security researchers filed <a href="https://www.heyuan110.com/posts/ai/2026-03-10-mcp-security-2026/" rel="noopener noreferrer">30 CVEs against

<p><em>A real scan walkthrough using DVWA</em><br /> <strong>By Eldor Zufarov, Founder of Auditor Core</strong><br /> <em>Originally published on <a

<p>Most coding platforms train engineers to solve isolated algorithm problems.</p> <p>But in real engineering, you rarely reverse linked lists.</p> <ul> <li>You debug production