An automated setup that checks daily for vulnerability news affecting a public server(zenn.dev)
Writing language: KoreanRead in the original language
Plain summary
- Developer tomi introduced a method that compares vulnerability news with information about the public server they run every day, and notifies them through a GitHub issue if action is needed.
- GitHub Actions reads the server's operating system and program versions over SSH, and fetches Cloudflare Zero Wire vulnerability news via RSS. It does not change the server's settings or restart it.
- Comparison with fixed versions is handled by code that uses official data, while Claude examines the conditions under which a vulnerability has an impact and whether the server is exposed. The author explained that when Claude was also given the version comparison, some cases remained in a state that needed confirmation.
- If the machine judgment finds an unfixed vulnerability, an issue is created regardless of Claude's result. The author does not allow Claude to run commands for connecting to the server, and configured it not to follow instructions in external documents.
Editorial opinion
O: I suggest using this setup as a model for a developer who is 1 and runs a server with Node.js installed through nvm, when creating a daily morning check for whether the server has a patched version.
X: The author says that when Claude was also tasked with comparing versions, it could not verify whether the fix was present, leaving it marked for verification. The comparison therefore needs to be confirmed separately using official data and code.
Writing language: Korean
Found on
はてなブックマーク テクノロジー ↗ / Published by source
Have you run into something like this? Tell us in a line or two what you did. You do not need to know the product.