Enrichment

Cloudflare AI Gateway-backed inference passes that run post-commit after a primary CVE write, best-effort and bounded by the run's time budget. Documents the vulnetix.* activities, the source-category coverage, and the operator runbook.

Resolves the registry first-publish date and removal status of every known-malicious package from deps.dev, so the OSSF exposure window (how long a malicious package was installable before its advisory landed) is computed live from the database instead of a baked constant.

Builds customer-relevant CVE facts and exact Resolve dashboard metric responses outside the API request path.

Enriches CVE records with Coalition ESS (Exploit Scoring System) data.

Enriches CVE records with FIRST.org EPSS (Exploit Prediction Scoring System) scores.

Enriches package records from the Google OSI (deps.dev) API — provenance, publish dates, SLSA attestations and the upstream GitHub repo — for both CVE-named packages and the wider registry corpus.

Searches GitHub for Nmap NSE scripts that reference CVE/GHSA identifiers, stores them as first-class `Exploit` records, and creates `ExploitCVE` junctions linking to all matching `CVEMetadata` rows...

Enriches CVE records with Nuclei template and ExploitDB exploit data.

Categorizes and enriches CVE reference URLs by fetching metadata from ExploitDB, GitHub, VulnerabilityLab, and other sources.

Populates the GitHub* tables for GitHubRepository rows queued with needsEnrichment=true, via the GitHub REST API.

Forms the organisation-wide tech-stack graph by matching join keys published by independent single-repository scans, and computes the metrics no single repository can see.