HashiCorp HCSEC RSS Processor — Design
Overview
Ingests HashiCorp Security Bulletins (HCSEC-YYYY-NN) from the public
Discourse RSS feed and emits CVEMetadata rows under source="hashicorp",
plus dual HCP + Enterprise CRIT envelopes per affected HashiCorp product
(Vault, Consul, Boundary, Terraform, Nomad, Packer).
Identifier policy: prefer the CVE-* alias from the body as the primary
cveId; fall back to a minted HCSEC-YYYY-NNNN issuance when no CVE is
referenced. The native HCSEC-YYYY-NN id is always written as a CVEAlias.
Data Source
| Property | Value |
|---|---|
| URL | https://discuss.hashicorp.com/c/security-bulletins/52.rss |
| Auth | None — fully public |
| Format | Discourse RSS feed |
| Note | 301-redirects to /c/security/52.rss as of 2026-05 |
Storage
| Table | Rows inserted |
|---|---|
CVEMetadata | One per advisory; source="hashicorp" |
CVEAlias | HCSEC id (and CVE bundle) linked to the primary id |
| CRIT envelopes | Dual HCP (cloud) + Enterprise/OSS per affected product |
Plus related description, reference, and affected rows via the central store path.
Flags
| Flag | Default | Description |
|---|---|---|
--force | false | Reprocess all advisories, not just new ones |
ECS Schedule
Runs daily at 17:00 UTC (cron(0 17 * * ? *)).
CloudWatch logs retain 3 days, then archive to S3 (Glacier Deep Archive).
S3 Persistence
Not used. This processor does not currently archive payloads or quarantine failures to S3. Per the S3 Persistence Contract this is non-compliant — see the compliance matrix for the implementation roadmap.
⚠ Not in the compliance matrix — status needs verification.
Expected paths when implemented:
- Archive:
hashicorp-hcsec/files/{sha256}/{filename} - Quarantine:
failed-feeds/hashicorp-hcsec-rss-processor/{YYYY-MM-DD}/{reason}/{filename} - Likely reasons: (none documented)