vulncheck
97562abed0
Answers 'is vendor readable via the Intune/Defender API?' — yes: - Intune detectedApps.publisher was being dropped in _map_apps; now kept as the package vendor. - Defender softwareVendor was folded into the package label; now stored separately. - Wazuh syscollector already carries vendor; now threaded through. New vulnerabilities.package_vendor column (migration 038, idempotent), populated at the package-finding chokepoints (app_cve_scanner._upsert + cvelistv5 scan_asset via pkg vendor, defender _upsert_cve) and shown in the Affected Package card on the CVE detail page. Scope: single-package findings. Per-package (vulnerability_packages) and Nessus/m365 vendor left as follow-up — Nessus rolls vendor into the plugin name and m365/OS vendor is implicit (Microsoft).
TrueVuln Frontend
Next.js 16 (App Router) UI for TrueVuln. See the root README for setup, deployment, and configuration — this app is deployed via Docker Compose alongside the backend, not standalone or on Vercel.
Local dev (without Docker)
npm install
npm run dev
Open http://localhost:3000. The dev server proxies API calls to the backend — see ../README.DEV.md for the full local (non-Docker) setup.