How 3d74r08/vulntrack works
VulnTrack is a multi-tenant vulnerability-management platform. Its main workflow registers assets, records or imports findings, enriches CVEs with NVD data, evaluates risk, and manages remediation through monitored SLAs. The React client calls an Express API; PostgreSQL RLS isolates tenant data, while a separate worker handles scheduled checks and enrichment. The README also documents a scanner and Redis, but sampled source does not establish their internal request or storage wiring, so those links are shown only where explicitly documented. Several less-sampled API areas are grouped by their existing directories.
Main entry points: server.js Express API · vulnerabilidadService.js Vulnerability lifecycle · Dashboard.jsx Dashboard views · riesgoService.js Risk evaluation
Components 27
User interface
- React application
frontend/src/App.jsx - Dashboard views
frontend/src/Dashboard.jsx - Asset inventory
frontend/src/views/ActivosView.jsx - Vulnerability views
frontend/src/views/VulnerabilidadesView.jsx - Remediation views
frontend/src/views/RemediacionesView.jsx - Supporting views
frontend/src/views - API client
frontend/src/utils/apiClient.js
API and security
- Express API
backend/src/server.js - Authentication
backend/src/controllers/authController.js - Token and RBAC
backend/src/middlewares/roleMiddleware.js - Admin and reporting
backend/src/controllers
Vulnerability workflow
- Asset management
backend/src/controllers/activosController.js - Finding intake
backend/src/controllers/hallazgosController.js - Bulk import
backend/src/controllers/importacionController.js - Vulnerability lifecycle
backend/src/services/vulnerabilidadService.js - NVD enrichment
backend/src/services/nvdService.js - Risk evaluation
backend/src/services/riesgoService.js - Remediation plans
backend/src/controllers/remediacionController.js - Plan automation
backend/src/services/remediacionService.js
Background operations
- Scheduled worker
backend/src/workers/slaWorker.js - Scanner process
scanner/src/index.js
Data and integrations
- Tenant DB access
backend/src/config/db.js - PostgreSQL + RLS
- Redis
- NVD / NIST
- Email service
Other components
- User / browser
Connections 39
- User / browser → React application: uses
- React application → Dashboard views: renders
frontend/src/App.jsx - Dashboard views → Asset inventory: renders
frontend/src/Dashboard.jsx - Dashboard views → Vulnerability views: renders
frontend/src/Dashboard.jsx - Dashboard views → Remediation views: renders
frontend/src/Dashboard.jsx - Dashboard views → Supporting views: renders
frontend/src/Dashboard.jsx - Asset inventory → API client: requests data
frontend/src/views/ActivosView.jsx - Vulnerability views → API client: requests data
frontend/src/views/VulnerabilidadesView.jsx - Remediation views → API client: requests data
- API client → Express API: calls REST
- Scanner process → Express API: calls API
- Express API → Authentication: routes auth
backend/src/server.js - Express API → Asset management: routes assets
backend/src/server.js - Express API → Finding intake: routes findings
backend/src/server.js - Express API → Bulk import: routes imports
backend/src/server.js - Express API → Remediation plans: routes plans
backend/src/server.js - Express API → Admin and reporting: routes other areas
backend/src/server.js - Express API → Token and RBAC: protects routes
- Finding intake → Vulnerability lifecycle: creates findings
backend/src/controllers/hallazgosController.js - Finding intake → NVD enrichment: looks up CVEs
backend/src/controllers/hallazgosController.js - Finding intake → Risk evaluation: evaluates risk
backend/src/controllers/hallazgosController.js - Bulk import → NVD enrichment: looks up CVEs
backend/src/controllers/importacionController.js - Bulk import → Vulnerability lifecycle: creates findings
backend/src/controllers/importacionController.js - Vulnerability lifecycle → NVD enrichment: enriches CVE
backend/src/services/vulnerabilidadService.js - Vulnerability lifecycle → Risk evaluation: evaluates risk
backend/src/services/vulnerabilidadService.js - Risk evaluation → Plan automation: creates plans
backend/src/services/riesgoService.js - Remediation plans → Vulnerability lifecycle: updates status
backend/src/controllers/remediacionController.js - Remediation plans → Plan automation: manages plans
backend/src/controllers/remediacionController.js - Asset management → Tenant DB access: queries tenant data
backend/src/controllers/activosController.js - Vulnerability lifecycle → Tenant DB access: reads and writes
backend/src/services/vulnerabilidadService.js - Risk evaluation → Tenant DB access: stores evaluations
backend/src/services/riesgoService.js - Plan automation → Tenant DB access: stores plans
backend/src/services/remediacionService.js - Tenant DB access → PostgreSQL + RLS: queries with RLS
backend/src/config/db.js - Express API → Redis: login rate limit
- Scheduled worker → PostgreSQL + RLS: checks SLA data
- Scheduled worker → NVD enrichment: enriches CVEs
backend/src/workers/slaWorker.js - Scheduled worker → Email service: sends alerts
backend/src/workers/slaWorker.js - Scheduled worker → Risk evaluation: reevaluates risk
backend/src/workers/slaWorker.js - NVD enrichment → NVD / NIST: queries source