About AppSec Pulse
Software vulnerability intelligence, with traceable evidence.
Mission
AppSec Pulse exists because application security engineers deserve threat intelligence built specifically for them. Not a filtered-down version of a general security platform. It is purpose-built to speak their language, cover their ecosystem, and respect their time.
No network CVEs. No endpoint vulnerabilities. No firmware. Only vulnerabilities that affect languages, runtimes, packages, libraries, frameworks, and the software supply chain.
Key Tools
Tools for reviewing evidence, prioritising vulnerabilities and checking dependencies.
Pulse Score demo
An illustrative prioritisation score combining severity, exploitation probability and exploit evidence. It is not a measurement of your exposure.
Live vulnerability ticker
Recently updated tracked vulnerabilities, linked to their evidence and detail pages.
Patch Tracker
Package fix information and remediation links, with source details where available. Check the vendor advisory before upgrading.
SBOM Scanner
Check supported lockfiles and SBOMs against tracked vulnerabilities. Files are parsed locally; package identifiers are sent for matching.
What Makes It Different
AppSec Focus
Filtering is designed to focus on software vulnerabilities and exclude network, hardware and firmware issues.
Built on Industry Standards
CVE, CWE, CVSS, EPSS, PURL and SSVC form the foundation of our contextualisation layer.
Traceable Evidence
Source links and timeline signals help you check where reported information came from.
AI-Assisted Analysis
AI summarises available evidence. Citation checks reduce unsupported output, but errors are still possible.
Evidence Before Action
Review primary advisories, affected versions and your own exposure before making remediation decisions.
Vulnerability Lifecycle
Stage 1: Early Signal
Initial reported evidence. Treat as a watch item until stronger evidence is available.
Stage 2: Corroborated
Supporting signals strengthen the report. A public proof of concept is not, by itself, evidence of exploitation in the wild.
Stage 3: Confirmed
Authoritative evidence supports the vulnerability. Confirmation does not mean it affects your deployed version.
Stage 4: Actively Exploited
Requires a match to the CISA Known Exploited Vulnerabilities catalogue. This status does not imply exploitation of your systems.
Stages describe the available evidence. Confidence Score measures evidence strength; Pulse Score supports prioritisation. Neither is a direct measurement of your exposure.
Live Feed Ingestion
Scheduled pipelines collect vulnerability records, exploit evidence and enrichment data. The Sources page shows contributing sources and recorded pipeline status.
Vulnerability records and advisories
Exploit evidence
Ecosystem feeds
Enrichment
AI Safety & Data Verification
Automated checks reduce unsupported content and incorrect stage assignments. They cannot guarantee that every source or AI-generated statement is accurate.
✓ Citation Verification
AI summaries are blocked when more than half of their citations cannot be verified against recorded evidence or recognised source references. A passing citation check is not proof that the claim is correct.
✓ Exploitation Status Protection
"Actively Exploited" is exclusively controlled by verified CISA KEV data. Daily integrity audits enforce this.
✓ Source URL Reachability
Timeline URLs are periodically checked via HTTP HEAD requests. Dead links are flagged and reported.
✓ Social Post Integrity
Only accepted from verified platform domains. Posts with unrecognised URLs are rejected at ingestion.
✓ AI Guardrails
Source-based instructions and validation checks are intended to reduce unsupported claims. AI output still needs human judgement.
✓ Daily Integrity Audit
Automated audit at 04:00 UTC scanning for false promotions, dead URLs, invalid posts, and unverified citations.
How the AI Layer Works
AI supports deduplication, classification and analysis using available source evidence. Summaries can be pending, withheld or incomplete.
Semantic Deduplication
Identifies vulns under different identifiers by analysing titles, packages, CWEs, and descriptions for semantic similarity.
Title Consolidation
Synthesises standardised AppSec-focused titles from all contributing sources. Titles only use facts present in source data.
AppSec Relevance Classification
Second-pass AI classifier catches infrastructure vulns the regex missed. Non-AppSec entries removed with audit logging.
Content Synthesis
TL;DR briefs, technical deep-dives, and severity assessments with inline citations. Outputs with >50% unverifiable citations are blocked.
Weekly Threat Briefings
CWE category spikes, ecosystem-specific attack waves, and prioritised recommendations. References only data present in the platform.
Industry Standards
AppSec Pulse does not invent new standards. It builds an aggregation and contextualisation layer on top of what the industry already recognises:
Data Refresh & Processing
The ASP Identifier
For vulnerabilities that don't yet have a CVE assigned, AppSec Pulse assigns a platform identifier in the format ASP-YYYY-XXXX. When a CVE is later assigned, the vulnerability page merges and the CVE becomes the primary identifier. The ASP ID is retained so existing links continue to work.
Limitations
AppSec Pulse is an intelligence layer, not a replacement for SAST, DAST or SCA tooling. Early Signal entries are unverified and should be treated as watch items only. Always verify critical findings through the cited primary sources before taking action.
AI-generated content, even with verification guardrails, should be treated as a synthesis aid. The inline citations allow you to verify every claim against the original source.
Support
Built and maintained by a small team of application security engineers. If you find the platform useful, consider supporting us.
☕ Buy us a coffeeContact
For source nominations, feedback, vulnerability reports, or general enquiries:
hello@appsecpulse.com