OpenVigie is an open-source, asset-centric cybersecurity and vulnerability intelligence platform.
Instead of showing another endless CVE feed, OpenVigie starts with the products and versions that make up an infrastructure. It then correlates vendor advisories, public vulnerability databases, exploitation signals, defensive detection templates, and remediation guidance.
Project status: early public prototype. Asset monitoring and the automatic source feed are functional, while the long-form editorial dossiers remain demonstration content. OpenVigie must not be treated as a production vulnerability assessment or as an automatically verified newsroom.
Get OpenVigie running in 3 commands:
git clone https://github.com/Swapshadow/openvigie.git
cd openvigie
chmod +x start.sh && ./start.sh # Linux / macOS.\start.ps1 # WindowsThis command automatically detects whether your machine has a compatible GPU and enables acceleration for Vigi if possible, otherwise it starts in CPU mode — either way, it tells you which one was chosen.
Windows note: if the script doesn't detect a GPU you know you have, check
that a real Python interpreter is installed — py --version should print a
version. On a stock Windows install, the python/python3 commands often
point to non-functional Microsoft Store app stubs instead; install Python from
python.org if py --version fails too.
Then open http://localhost:3000 in your browser (Caddy also serves https://localhost, see README-QUICKSTART.md).
Requirements: Docker Desktop installed. 8 GB RAM recommended for the Vigi AI assistant (Mistral 7B Instruct runs locally in Docker). GPU acceleration is optional — never required to run OpenVigie.
Advanced / scripted setup — plain docker compose (always CPU, no detection step)
docker compose up -dEquivalent to start.sh/start.ps1 minus the GPU detection: useful for
automation, CI, or if you'd simply rather not run the wrapper. This is exactly
what the wrapper falls back to on machines without a usable GPU, so it always
works — you just don't get GPU acceleration this way.
- Asset first: vendor, product, version, exposure, and business context.
- Traceable: every claim should link back to a primary or clearly identified public source.
- Explainable: show why an asset is considered affected and how the attack works at a defensive level.
- Risk focused: distinguish severity, active exploitation, public PoCs, and weaponized tooling.
- Safe by design: OpenVigie references public evidence but does not execute exploits.
- Open: auditable collectors, transparent matching rules, and community contributions.
The Bulletin unifié displays a curated feed of cybersecurity news and vulnerabilities, refreshed every three hours from 44+ specialist RSS/Atom sources.
- Article images — cover images are extracted from feed enclosures, Media RSS metadata, or article HTML and displayed as lazy-loaded thumbnails in the feed.
- Vigi — local AI assistant — a chatbot powered by Mistral 7B Instruct (~4.1 GB, meilleur français, recommandé; 100% local, runs in Docker) that answers questions about the bulletin and your asset inventory. Vigi correlates CVEs, exploitation status, and remediation guidance without sending data to external AI services.
- Weekly report (
/rapport-hebdo) — synthesizes the past 7 days with:- Top CVE ranked by CISA KEV status and mention count;
- Top news stories by relevance;
- Trending keywords extracted from article titles and summaries;
- Category breakdown (vulnerabilities, data breaches, threat campaigns, etc.);
- One-click export to PDF and HTML for archival or sharing.
Two operational desks support infrastructure watch: Software supply chain covers malicious packages, dependency risks, SBOM, build provenance, and artifact signing; VPN & remote access covers edge appliances, SSL-VPN/IPsec gateways, remote clients, and actively exploited perimeter vulnerabilities.
The collector refreshes feeds every three hours, stores article metadata in SQLite, removes tracking parameters, detects CVE identifiers, classifies themes, and keeps source diversity in automatic ranking. It runs continuously even when the browser is closed.
OpenVigie stores only the title, author when supplied by the feed, a short plain-text excerpt, dates, attribution, the original link, and a cover image URL (when available). It does not copy article bodies or rewrite source claims. See EDITORIAL_POLICY.md.
The My assets workspace now lets users:
- add a vendor, product, installed version, local label, and exposure context;
- keep that inventory locally in the browser, without sending IP addresses or credentials;
- query NVD from the OpenVigie server using an exact CPE and version whenever a reliable mapping is available;
- correlate matching CVEs with the CISA Known Exploited Vulnerabilities catalog;
- filter by severity, exploitation status, CVE identifier, or description;
- open primary vendor advisories, patches, mitigations, and NVD evidence; and
- correlate recent CERT-FR alerts and security advisories with the monitored vendor, product, version, and matching CVE identifiers; and
- refresh every registered product/version snapshot automatically each day.
With Docker, a dedicated collector stores normalized snapshots in a SQLite volume and continues refreshing monitored product/version queries while the browser tab is closed. If NVD or CISA is temporarily unavailable, OpenVigie can serve the latest known snapshot and mark it as stale.
The interface labels text-search fallback matches as lower confidence. Always confirm affected and fixed version ranges in the linked vendor advisory before changing production infrastructure.
OpenVigie works with the public NVD rate limit. For larger inventories, copy
.env.example to .env, add an optional NVD_API_KEY, and restart Docker.
- NVD / NIST CVE API 2.0 and CISA Known Exploited Vulnerabilities;
- CERT-FR / ANSSI alertes and avis as two dedicated bulletin pages, CISA Cybersecurity Advisories, and CERT-EU;
- NCSC UK, Cisco PSIRT, and Palo Alto Networks Security Advisories;
- OpenSSF and GitHub Supply Chain Security;
- SentinelLabs, Cisco Talos, Unit 42, CrowdStrike, ESET, Zero Day Initiative, watchTowr Labs, and PortSwigger Research;
- BleepingComputer, The Record, Krebs on Security, and Schneier on Security;
- ZATAZ cybersecurity news;
- Anthropic Security — AI safety and security research;
- OpenAI Atlas — AI editor updates and agent/model announcements;
- Google Project Zero — vulnerability research and disclosure;
- Freedom of the Press Foundation, Electronic Frontier Foundation, Access Now, Citizen Lab, Amnesty Security Lab, and Forbidden Stories;
- Microsoft Security Response Center, Google Security Blog, Mozilla Security, Cloudflare, and SANS Internet Storm Center; and
- linked vendor security advisories and patch references from matching CVEs.
Each feed has a visible synchronization state. An unavailable source is marked as degraded without preventing the latest stored articles from being read.
The asset catalog covers network, firewall, VPN, EDR/XDR, server, virtualization, storage, backup, and orchestration products from more than 25 vendors. Products without a reliable public CPE mapping use a visibly lower-confidence text search and always link to the vendor security portal.
- FIRST EPSS
- Additional vendor PSIRT advisories
- Exploit-DB / SearchSploit metadata
- Metasploit module metadata
- Nuclei template metadata
openvigie/
├── apps/
│ └── web/ Miami-inspired interface and API gateway
└── services/
└── collector/ Scheduled NVD/CISA collection and SQLite cache
From the repository root:
docker compose up --buildThen open http://localhost:3000. Stop the application with Ctrl+C, or run
docker compose down from another terminal.
The Docker stack includes Ollama and Mistral 7B Instruct. No host installation is required on Windows, Linux, or macOS. Start the complete stack normally:
docker compose up -d --build
The ollama-model initialization container downloads the model on first start;
subsequent starts reuse the openvigie_ollama Docker volume. Ollama is exposed
only on the host loopback interface at http://localhost:11434 and is available
to the web app at http://ollama:11434. To select another model or host port,
set OLLAMA_MODEL or OLLAMA_PORT in .env.
Memory requirements: Mistral 7B Instruct needs at least 6 GB of memory, with 8 GB recommended for responsive performance on personal computers. OpenVigie defaults to a 2048-token context and one parallel inference to keep resource usage predictable.
GPU acceleration (optional): on Windows or Linux with a compatible NVIDIA
GPU, ./start.sh / .\start.ps1 (see Quickstart) detect it
automatically and roughly halve response time or better. Not available on
macOS — Docker Desktop cannot expose a GPU to containers there, a
virtualization limitation rather than something to configure around.
How Vigi works: Ollama does not browse the web. The OpenVigie collector fetches attributed RSS/Atom news and primary security sources, then Vigi (Mistral 7B Instruct) analyzes and answers questions about those items locally, without sending data to cloud AI services. Vigi can cross-reference the bulletin with your declared asset inventory to identify relevant vulnerabilities.
The local chat endpoint is available at /api/ai/chat; Vigi is also accessible
as a floating chatbot in the web UI.
The Docker image copies the application into the container instead of mounting
the macOS project directory. This avoids intermittent file-sharing EIO errors
on Docker Desktop.
Requirements:
- Node.js 22.13 or newer
- pnpm
cd apps/web
pnpm install
pnpm devThen open http://localhost:3000.
OpenVigie is intended for defensive monitoring, education, remediation, and authorized security validation. Do not use information referenced by the project against systems you do not own or have explicit permission to test.
Please report security issues privately as described in SECURITY.md.
Contributions are welcome. See CONTRIBUTING.md before opening a pull request.
OpenVigie is licensed under the GNU Affero General Public License v3.0. You may use, study, modify, and redistribute it under the terms of that license. Modified versions made available to users over a network must provide the corresponding source code as required by the AGPL.
See LICENSE for the complete terms.
OpenVigie was initiated by Swapshadow. The initial product concept and prototype were developed collaboratively with OpenAI Codex.
The gear menu opens SMTP settings, notifications, inventory, theme and project information. The bell displays persistent notifications for each monitored product/version and CVE. The first successful collection creates notifications for all matching CVEs. Later collections are deduplicated, including across restarts. Confirm matches in the vendor advisory. Equipment identity uses the existing collector product/version key, shared across browsers.
Set OPENVIGIE_SECRET_KEY in the collector environment to a persistent random secret of at
least 32 characters. Generate one with python -c "import secrets; print(secrets.token_urlsafe(48))"
and save it in the ignored .env file. Restart the collector. Never commit the key.
Passwords use Fernet with a SHA-256-derived key. Back up the key securely with the database;
changing it requires re-entering the SMTP password. API responses never return passwords
or ciphertext. Leaving the password blank preserves it.
Configure SMTP, save recipients, test TLS/authentication, then enable delivery. The test does not send email. Gmail uses an app password. Proton uses SMTP submission credentials for an eligible plan: https://proton.me/support/smtp-submission. Outlook.com requires OAuth2: https://support.microsoft.com/en-US/Outlook/pop-imap-and-smtp-settings-for-outlook-com. This password-based SMTP service requires a compatible relay for those accounts; the Outlook preset does not implement OAuth2. TLS certificate validation is mandatory.
The outbox checks every 30 seconds, retrying failures after five minutes. Enabling email sends pending notifications. Delivery is tracked per recipient so partial failures do not resend to recipients already accepted by SMTP. A crash between SMTP acceptance and the SQLite acknowledgement can still produce a duplicate. Removed monitored queries keep their notification history but no longer send pending emails.
Settings follow the existing single-instance trust model: restrict the web application to trusted operators or an authenticated reverse proxy, and do not expose the collector publicly. The new web write routes reject cross-origin requests.
API: GET/POST /api/settings/email-config, POST /api/settings/email-config/test,
GET/POST/PUT/DELETE /api/settings/email-recipients (JSON {id,email} as applicable),
GET /api/notifications?offset=0 (50 per page), POST /api/notifications/read ({id}),
and POST /api/notifications/mark-all-read ({}). Writes use application/json.
Backend checks: install services/collector/requirements.txt, then run
python -m py_compile services/collector/collector.py services/collector/email_notifier.py
and python -m unittest discover -s services/collector -p "test_*.py".
For local web development set OPENVIGIE_COLLECTOR_URL=http://127.0.0.1:8787 and run the
collector locally with OPENVIGIE_DB_PATH pointing to a writable SQLite file.
Un cycle de détection crée un seul digest par équipement et par destinataire,
y compris le premier inventaire (initial_scan=true). Les cycles suivants ne
contiennent que les nouvelles CVE confirmées ; un cycle sans nouvelle CVE ne
renvoie rien. L’analyse initiale envoie aussi un bilan à zéro correspondance
confirmée, sans inclure les CVE ambiguës. Les notifications restent individuelles.
detection_cycles garde les lots, notifications.cycle_id leur rattachement et
digest_deliveries les accusés par destinataire. Les reprises ne fractionnent
jamais un lot à cause d’une limite de 20 notifications. Le reliquat historique
est regroupé une fois par équipement. Les garanties SMTP restent « au moins une
fois » en cas de crash entre acceptation SMTP et enregistrement SQLite.
- Jean-Baptiste Terrazzoni (Swapshadow) — project creator and maintainer.
- OpenAI Codex — AI-assisted interface redesign, navigation, responsive dark/light themes and verification (September 2026). Contribution recorded in the commit co-author trailer.